Overview
Whether you run in AWS, Azure, Google Cloud or all three, attackers look for over-privileged identities, exposed storage and weak network controls. We test those paths within each provider's published testing policy and map results to CIS Benchmarks, SOC 2 and HIPAA. FedRAMP requires annual penetration testing by a 3PAO; we are not a 3PAO, so we'll say so at scoping.
Most cloud breaches don't involve exotic exploits. They start with an over-permissive role, a leaked access key in a repository, a publicly readable storage bucket or a compromised CI/CD runner — and move quickly from there.
Our cloud penetration tests combine a configuration review against recognized benchmarks with hands-on exploitation. Starting from realiztic footholds — an external attacker, a compromised developer credential or a vulnerable workload — we map how far an attacker could get and which data they could reach.
The result is a prioritized view of the attack paths that matter, not a list of thousands of low-value configuration warnings.
How testing works for US organizations
- Signed scope and written authorization before any testing, including hosting and cloud provider permissions
- Testing windows agreed around your US time zone at scoping, including after-hours windows for production
- Fully remote delivery, with internal and wireless access via VPN or a shipped test device, so no travel costs
- Reports mapped to SOC 2, PCI DSS, HIPAA and customer questionnaires, with a fixed price in USD
What's included
Our approach
- Read-only access & inventoryWe review configuration with read-only credentials and build an asset and identity map.
- Benchmark reviewSettings are compared against CIS benchmarks and provider best practice.
- Attack path analysisWe identify privilege-escalation and lateral-movement paths through IAM and services.
- Exploitation (agreed scope)Selected paths are safely exploited to prove impact.
- Report & hardening planPrioritized fixes, infrastructure-as-code recommendations and a retest.
What you receive
- Attack path narratives with evidence
- CIS benchmark gap summary
- IAM least-privilege recommendations
- Infrastructure-as-code fix guidance
- Retest report and attestation letter
Standards & frameworks
- CIS Benchmarks
- AWS Well-Architected (Security)
- Microsoft cloud security benchmark
- MITRE ATT&CK Cloud
- ISO 27017
- SOC 2
- PCI DSS 11.4
Frequently asked questions
Do we need permission from our cloud provider?
AWS, Azure and Google Cloud permit customers to test their own resources for most services without prior approval, subject to their published policies. We review the current policy with you during scoping.
Is a configuration review the same as a cloud pentest?
No. A review checks settings against benchmarks; a penetration test also proves exploitability by following attack paths to sensitive data.
Can you test multi-account or multi-cloud environments?
Yes. We scope by accounts, subscriptions or projects and prioritize production and identity-critical environments.
Are you a PCI QSA or ASV, FedRAMP 3PAO or CMMC C3PAO?
No. We don't claim any of those statuses on this site. Most penetration tests for SOC 2, HIPAA, PCI DSS Requirement 11.4, the FTC Safeguards Rule and customer due diligence don't require them. If your contract, assessor or program requires a specific accredited provider, tell us at scoping and we'll say plainly whether we can meet it. See US compliance requirements.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.