Cloud Penetration Testing

Flow chart of the Cloud engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Rules of Engagement. We agree the accounts, subscriptions and projects in scope, the provider mix, and the read-only and test roles we will use. Activities: Confirm accounts, subscriptions and projects; Agree the provider mix in scope; Provision read-only and test roles; Set testing windows and contacts. Hands over Signed Rules of Engagement. Phase 2, Configuration Review. We assess your accounts against CIS Benchmarks and provider baselines, covering storage, networking, logging and encryption. Activities: Benchmark accounts against CIS baselines; Review storage and network exposure; Check logging and monitoring coverage; Assess encryption at rest and in transit. Hands over Configuration Review Findings. Phase 3, IAM and Identity Analysis. We map roles, policies and trust relationships to find over-permissive access, weak boundaries and risky federation. Activities: Map roles, policies and trust relationships; Find over-permissive and unused access; Assess account and service boundaries; Review federation and identity providers. Hands over IAM Analysis Findings. Phase 4, Manual Exploitation. We follow identity attack paths, escalating privileges and pivoting between services the way an attacker with a foothold would. Activities: Follow identity attack paths from a foothold; Escalate privileges across roles; Pivot between services and accounts; Confirm impact and rule out false positives. Hands over Proven Attack Paths. Phase 5, Post-Exploitation and Impact. We show what the chained paths reach, from data stores to secrets and workloads, and how far a single leaked credential goes. Activities: Show what chained paths reach; Map exposed data stores, secrets and workloads; Trace the blast radius of a leaked credential; Rank findings by real impact. Hands over Impact and Risk Assessment. Phase 6, Reporting and Verified Retest. You get a report with attack paths and prioritised fixes per provider, and we retest once you remediate to confirm closure. Activities: Document attack paths and per-provider fixes; Produce an executive summary; Walk your team through the results; Retest fixes and confirm closure. Hands over Final Report and Verified Retest. Each phase begins from the artefact the phase before it produced.