Identity and access management
Multi-factor authentication for administrators and users, root and owner accounts, unused and long-lived access keys, overly broad roles and permissions, and how guest and external identities are controlled.
Cloud Security Audit
Your cloud, checked setting by setting.
AWS, Azure and Google Cloud make it easy to build fast, and just as easy to leave a storage bucket public, logging switched off or an old access key live. We audit your cloud configuration against the CIS Foundations Benchmarks and tell you, in plain English, exactly what to change.
AWS, Azure and Google Cloud
Read-only, no changes
Checked against CIS Benchmarks
Shared responsibility
Your provider secures the cloud. Securing what you put in it is up to you.
AWS, Microsoft and Google run the data centres, the hardware and the platform. How your accounts, storage, networks and identities are configured is your side of the deal.
That is where cloud breaches start: a storage bucket left open to the internet, an administrator account without multi-factor authentication, an access key that was never rotated, or audit logging that was never switched on, so nobody would know if something went wrong. The controls to prevent all of it are there, but they are spread across hundreds of settings, many are off by default, and environments drift as teams build quickly.
A cloud security audit finds those gaps and tells you exactly how to close them. It is carried out through read-only access your administrator sets up and removes afterwards, so there is nothing to install, nothing is changed and your services carry on as normal.
At a glance
What the audit does
- Checks every enabled region, not a sample
- Finds gaps in identity, MFA and privileged access
- Spots public storage, open network rules and missing encryption
- Confirms logging and monitoring are actually on
- Gives you the exact setting to change for each finding
Scope
What we review
Logging and monitoring
Audit trails such as CloudTrail, Azure activity logs and Google Cloud audit logs, how long logs are kept and whether they are protected, and the alerts that should fire on high-risk changes.
Storage and databases
Publicly accessible storage buckets and containers, encryption at rest and in transit, database exposure and backup settings, so your data is not one setting away from the internet.
Networking and exposure
Security groups and firewall rules open to the internet, remote administration ports such as SSH and RDP, flow logging, and the default networks that are easy to forget about.
Encryption and key management
How encryption keys and secrets are stored, who can use them, and whether rotation and protection settings are in place for the keys that guard your most sensitive data.
Security services and posture
Whether the provider's own protective services are switched on and configured, from threat detection to configuration recording, so you are getting the protection you already pay for.
We cover Amazon Web Services accounts, Microsoft Azure subscriptions and tenants, and Google Cloud projects and organisations, across every enabled region. Several accounts, subscriptions or projects, on one provider or more, can be audited together and reported side by side.
Audited to a recognised standard
Independent benchmarks, reviewed by a person
Your environment is assessed against the CIS Foundations Benchmark for each provider: the CIS Amazon Web Services Foundations Benchmark, the CIS Microsoft Azure Foundations Benchmark and the CIS Google Cloud Platform Foundation Benchmark. These are the independent, consensus-based standards for securing each platform, and every finding references the control it relates to.
Automated checks give complete, repeatable coverage across every region and resource. The judgement about which findings genuinely matter, and which fixes make sense for the way your environment is built and run, comes from the person doing the audit, who reviews every result before it reaches your report.
Deliverables
A report you can act on straight away
Written for the board and the technical team
- Each finding graded by severity, with what it exposes and why it matters
- The specific setting to change and where to find it, ready for your team or IT provider to apply
- Results across every account, subscription or project in scope, side by side
How it works
Straightforward from first email to final report
Tell us about your cloud
A short enquiry, answered by a tester rather than a sales team.
A quick scoping call
15 to 30 minutes to confirm your providers and the accounts, subscriptions or projects in scope.
A fixed-price quote
Clear scope, clear price, clear dates, typically within 48 hours.
Grant read-only access
We send your administrator a one-page guide that sets up read-only access in a few minutes.
Get the report, remove access
We audit your environment and hand over the report, and you remove our access.
Working towards Cyber Essentials?
Cloud services are in scope. So is your cloud infrastructure.
Cyber Essentials covers the cloud services you use and expects multi-factor authentication, secure configuration and tightly controlled administrator accounts across them. An audit checks those controls in your AWS, Azure or Google Cloud environment so you can fix the gaps before your assessment.
It also pairs naturally with an external infrastructure penetration test: the audit checks how your cloud is configured from the inside, and the test shows what an attacker can actually reach from the internet. If your email and files live in Microsoft 365, a Microsoft 365 security audit covers that side too.
Cyber Essentials certification
Where it fits
An audit supports
- Cyber Essentials and Cyber Essentials Plus readiness
- ISO 27001 access control and cloud security controls
- Cyber insurance, supplier and customer security questionnaires
- Due diligence before a launch, migration or investment
- A clean handover when you change cloud or IT provider
Common questions
Cloud security audits, answered.
What is a cloud security audit?
It is a detailed review of how your AWS, Microsoft Azure or Google Cloud environment is configured: identity and access, logging and monitoring, storage, networking, encryption and the security services each provider offers. Every setting is checked against the CIS Foundations Benchmark for that provider, and you get a prioritised list of the specific changes to make.
Which cloud platforms do you audit?
Amazon Web Services, Microsoft Azure and Google Cloud. We can audit one account, subscription or project, or several across more than one provider, and report on them together so you see your whole cloud estate in one place.
How do you get access to our cloud environment?
We send your administrator a one-page guide that sets up read-only access, which usually takes a few minutes. On AWS that is an audit role created from a template with an ID unique to you; on Azure and Google Cloud it is a single setup command that grants read-only roles. We never ask for a user account or a password, and you remove the access as soon as the audit is finished.
Will the audit change anything or affect our systems?
No. The access is read-only, so nothing in your environment is changed, nothing is installed on your workloads and your services carry on exactly as normal. The audit reads configuration only and does not open the contents of your files, databases or stored objects.
What standard do you audit against?
The CIS Foundations Benchmark for each provider: the CIS Amazon Web Services Foundations Benchmark, the CIS Microsoft Azure Foundations Benchmark and the CIS Google Cloud Platform Foundation Benchmark. These are the independent, consensus-based standards for securing each platform, and each finding references the control it relates to, so it stands up to scrutiny from auditors, insurers and customers.
Who carries out the audit?
An experienced, senior tester carries out your audit from scoping to report. Automated checks give complete, repeatable coverage, and every result is then reviewed by that person, not passed straight from a tool to your inbox.
We already use the provider's own security dashboard. Is this different?
Yes. Built-in tools such as AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center are useful, but they are generated by the provider, often depend on paid tiers being switched on, and say little about how much each gap matters to your business. An audit checks your real settings against an independent benchmark, explains each finding in plain English, and prioritises the fixes by risk and effort.
Does it help with Cyber Essentials?
Yes. Cyber Essentials covers the cloud services you use, including infrastructure you run on AWS, Azure or Google Cloud, and expects multi-factor authentication, secure configuration and properly controlled administrator accounts. An audit checks those controls across your cloud environment so you can fix the gaps before your assessment.
What do we get at the end?
A clear report with each finding graded by severity and linked to the benchmark control it relates to, and the specific setting to change and where to find it, ready for your team or IT provider to act on.
How much does a cloud security audit cost?
It depends on how many accounts, subscriptions or projects are in scope and which providers you use, so there is no fixed public price. Tell us roughly what you run and where, and we will come back with a fixed-price quote, typically within 48 hours.
Get a quote
Find out what your cloud audit would cost
Tell us which providers you use and roughly how many accounts, subscriptions or projects you run. We'll recommend a sensible scope and come back with a no-obligation, fixed-price quotation.
We read your enquiry
A real tester, not a sales team, so the first reply is already useful.
A short scoping call
15 to 30 minutes to understand your cloud and what you need to prove.
A fixed-price quote
Clear scope, clear price, clear dates, typically within 48 hours.
Not sure whether you need an audit, a penetration test or both? Tell us what you're trying to achieve and we'll help you scope it.