Skip to main content
VexaroSecurity
Cloud security assessment

Cloud security assessment

Most cloud risk sits in configuration and identity, which can't be seen from the outside. As part of our security audit, we review your AWS, Azure or GCP configuration against the CIS Benchmarks, focusing on the layer you are responsible for under the shared-responsibility model.

Scope

Configuration & identity review

This is a cloud configuration review delivered as part of our security audit, not a standalone cloud pentest. The security-relevant state lives in configuration and IAM, so we review it directly against the CIS Foundations Benchmarks, with the CSA Cloud Controls Matrix as a complement.

Typical scope
  • Identity & access: over-permissive IAM and privilege-escalation paths
  • Storage: public-access exposure and encryption at rest
  • Network: security-group and firewall rules, and exposed services
  • Logging, monitoring and key management
  • Role-assumption and cross-account / cross-tenant trust
  • Configuration mapped to CIS Benchmark controls (and CSA CCM domains)
How we work

Authenticated, configuration-centric

We work grey- or white-box from a read-only auditor role, because the findings that matter are in configuration and identity. Native tooling helps, but every finding is validated by hand. Any active testing stays within each provider's penetration-testing policy and the shared-responsibility model. We test your configuration and deployments, not the provider's infrastructure, and we never run denial-of-service tests against any provider.

  1. 1

    Scoping & authorisation

    We agree the accounts in scope, obtain written authorisation and sign an NDA before any access.

  2. 2

    Authenticated config review

    Using a read-only auditor role, we review configuration against the CIS Benchmarks across services.

  3. 3

    Identity & privilege analysis

    We analyse IAM for over-permission and privilege-escalation and trust-abuse paths.

  4. 4

    Exposed-asset testing

    We test externally exposed assets and validate findings, strictly within each provider's testing policy.

  5. 5

    Reporting & free re-test

    You get a prioritised report mapped to CIS controls; we re-test remediated items at no extra charge, within the window set in the Statement of Work.

Deliverables

What you receive

A report that maps configuration findings to recognised cloud baselines, with the depth of our sample report and clear remediation steps.

What you get
  • Executive summary and overall posture
  • Configuration findings mapped to the relevant CIS Benchmark controls
  • IAM and privilege-escalation findings with evidence and reproduction
  • Severity for exploitable findings via CVSS 3.1; posture findings rated by benchmark severity
  • Remediation aligned to the CIS Benchmark guidance
  • Free re-test of remediated issues, within the window set in the SoW
Methodology & standards

Grounded in CIS Benchmarks & CSA CCM

CIS BenchmarksCSA CCM v4.1Cloud provider testing policyShared responsibilityCVSS 3.1CWE

Configuration is reviewed against the CIS Foundations Benchmarks for AWS, Azure and GCP, with the CSA Cloud Controls Matrix as a complement. Any active testing stays within the AWS, Azure or GCP penetration-testing policy and the shared-responsibility model. We test your configuration, not the provider's infrastructure, and never run DoS tests. Provider policies and CIS versions change, so we re-confirm the applicable versions and rules at scoping. Pure configuration findings are rated by benchmark severity rather than CVSS, which is meant for software vulnerabilities.

Review your cloud.

Tell us which cloud accounts are in scope and what you'd like reviewed. We'll scope the work, agree the authorisation with you and deliver the report under NDA. The first consultation is free.