Cloud Security Configuration Review

We agree which accounts, subscriptions and projects are in scope and take read-only access. There is nothing intrusive here, so a review runs comfortably against production without any risk to availability, which is one reason many teams start with a configuration review before booking a full penetration test.

We gather configuration across the whole estate and measure it against the CIS Benchmark for your provider and each provider’s own security guidance. This produces the raw picture: every control, its current state, and where it deviates from the hardened baseline.

Then the real work. A benchmark will happily flag a hundred deviations, many of which do not matter for how you actually operate. We read each one in context, confirm the ones that represent genuine exposure, weed out the false positives, and rank what is left by real business risk. You get a short list of things that matter, not a spreadsheet nobody will read.

The output is an executive summary and a technical report where every finding has its risk, the affected resources, and a precise remediation step. After you make the changes, we re-review the affected controls for free to confirm the environment now meets the baseline and has not drifted elsewhere in the process.

Identities accumulate rights and rarely give them back. We consistently find users and roles with far more access than their job needs, service credentials that have not been rotated in years, and accounts belonging to people who left. Tightening this is the single highest-value outcome of most reviews.

Audit logging switched off in some accounts, logs with a retention period too short to investigate an incident, and no alerting on the events that actually signal compromise. Plenty of environments would not be able to reconstruct what happened after an attack. We check that the record you would need actually exists.

Buckets and volumes without encryption at rest, backups that are unencrypted or missing entirely, and storage quietly reachable from the public internet. We check exposure and encryption together, because one without the other still leaves data at risk.

Without organisation-level controls such as service control policies or Azure Policy, nothing stops a team from reintroducing yesterday’s misconfiguration tomorrow. We assess whether preventative guardrails exist, so the fixes from this review actually stay fixed.

The CIS Benchmarks for AWS, Azure and GCP are our primary yardstick. They give a widely recognised definition of a hardened configuration and a clear pass or fail for each control, which makes remediation and future measurement straightforward.

A configuration review produces strong evidence for the technical controls these frameworks require, and the report and attestation letter are structured to slot into your audit. Tell us which framework you answer to and we map the findings to it.

A configuration review tells you what is misconfigured; a penetration test proves what an attacker would actually do with it. The two are complementary, and where you need the adversarial view rather than the exhaustive audit, our cloud penetration testing service covers that ground.

The first pass establishes the baseline: where the estate stands today against the CIS Benchmark and provider guidance, and which deviations matter. This is the snapshot everything else is measured against, and for many teams it is the first time anyone has looked at the whole environment at once rather than one account at a time.

Findings come as a prioritised work list with the exact change for each one, so your team can start at the top and work down. Where a fix is unfamiliar or touches something fragile, we walk your engineers through it and explain the reasoning, so the remediation lands cleanly and nobody breaks a working service in the name of a benchmark control.

The hardest part is staying secure after the review. We recommend the preventative guardrails, such as service control policies, Azure Policy or organisation policies, and the automated configuration checks that catch a bad setting the moment it is created rather than at the next audit. A review that also leaves you with the means to hold the line is worth far more than a snapshot that goes stale in a month.