Skip to content
Book a test

home / services / network & cloud

// network & cloud

Network & cloud review

We map your external attack surface and review your AWS, Azure or GCP configuration against CIS Benchmarks — the exposed services, over-permissive IAM, public storage and leaked secrets that scanners flag but rarely connect into a real path in.

CIS BenchmarksCSA CCMMITRE ATT&CKCVSS 3.1 / 4.0

// scope

What's in scope

We scope every engagement in person-days against your real attack surface. Here's what a typical test of this kind covers.

In scope
  • External host and service discovery
  • Exposed admin panels, databases and dev endpoints
  • TLS, DNS and email (SPF/DKIM/DMARC) hygiene
  • IAM: over-permissive roles, unused keys, privilege paths
  • Storage: public buckets, blobs and snapshots
  • Secrets exposed in config, metadata or object storage
  • Network segmentation and security-group review
  • Lateral movement and privilege-escalation paths
Out of scope / by agreement
  • On-prem physical network access (by arrangement)
  • Destructive testing or DoS
  • Provider infrastructure you don't control

// method

How we test it

Manual-first, grounded in our five-stage methodology. Scanners cover ground; a person reproduces and proves every finding.

  1. 01

    Scope & authorize

    We agree in-scope IP ranges, accounts and cloud read access in a signed letter.

  2. 02

    Surface discovery

    Enumerate external hosts, ports and services; fingerprint stacks and find forgotten exposure.

  3. 03

    Config review

    Review IAM, storage, networking and logging against CIS Benchmarks for each cloud in scope.

  4. 04

    Prove a path

    Chain misconfigurations into a realistic attack path rather than a flat list of settings.

  5. 05

    Report & retest

    Prioritised findings with fixes, and a free retest once you remediate.

// deliverables

What you get

A report a developer can act on and a manager can understand — plus a free retest to confirm the fixes.

  • External attack-surface inventory
  • CIS-mapped cloud configuration findings by severity
  • Realistic attack paths, not just a settings checklist
  • Prioritised, provider-specific remediation steps
  • A free retest of every finding after you fix

// faq

Common questions

Do you need access to our cloud account?

Read-only access gives the most thorough config review. We can also work purely from the outside if you prefer a black-box external test.

Which clouds do you cover?

AWS, Azure and GCP. Multi-cloud environments are fine — we scope each provider separately.

Is this the same as a pentest?

It's complementary. This focuses on infrastructure and configuration; the web & API pentest focuses on your applications.

Ready to scope this?

Share your targets and timeline and we'll reply with a scope and a quote. Most scoping calls take thirty minutes.

Get a quoteSee a sample report