Cloud security assessment
A structured review of what your cloud estate actually looks like today — identity and privilege paths, network exposure, data protection, logging coverage and drift between environments — benchmarked against CIS and vendor baselines.
Updated
Scope
- Identity and access: Entra ID / Google Cloud IAM roles, privileged role assignments, Conditional Access, PIM, break-glass accounts, service principals and workload identities.
- Network exposure: public endpoints, NSGs and firewall rules, private connectivity, ingress paths, egress control and the routes that make non-production relevant to production.
- Data protection: encryption posture, key ownership and rotation, storage exposure, backup protection, data classification and DLP coverage where it is in scope.
- Detection: control-plane, identity, network and workload log sources shipped to Sentinel or the equivalent SIEM; retention and alert coverage against relevant MITRE ATT&CK cloud techniques.
- Posture management: Defender for Cloud / Wiz.io / native CSPM findings triaged against real exploitability, reachability, identity path and data sensitivity instead of raw score.
1Discover
- Agentless scan
- Config inventory
- Identity graph
2Prioritise
- Exploitability
- Data sensitivity
- Attack path length
3Route
- Owning team
- Backlog item
- Acceptance test
4Prevent
- Policy as code
- Hardened module
- Drift alert
How I avoid a noisy report
I use the applicable CIS Benchmarks and provider security baselines as the configuration reference, then test whether a gap is exposed in this estate. A CSPM result is evidence, not a severity model: an unreachable development resource and a path from a compromised workload identity to sensitive data do not belong in the same priority bucket.
Deliverables
| Deliverable | Audience | Format |
|---|---|---|
| Findings register | Security + engineering | Ranked list, exploitability and impact scored separately |
| Attack path narratives | Engineering | Identity, network and control-plane paths from initial access to sensitive data or privileged action |
| Baseline gap matrix | Compliance | Applicable CIS Benchmark, provider baseline and control-owner mapping |
| Remediation roadmap | Leadership | Quick wins, structural work, dependencies and budgeted items |
Typical findings
- Standing privileged access where PIM-style just-in-time elevation would do.
- Conditional Access policies with exclusion groups that quietly defeat the policy.
- Log sources enabled but never routed to the SIEM, so detections cannot fire.
- Landing-zone drift: production hardened, non-production wide open but connected.
Frequently asked questions
Which clouds do you cover?
Azure in most depth, then Google Cloud, and Alibaba Cloud.
Do you need production access?
Read-only reviewer access is enough for the assessment. Where that is not possible, exported configuration and screen-shared walkthroughs work.
Related
Cloud architecture review
Design-stage review of cloud and hybrid architecture: trust boundaries, identity model, segmentation, key management and detection design.
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
Microsoft Defender for Cloud
Defender for Cloud for Azure-native CSPM, multicloud extension, container posture and AI workload security posture management.
Wiz.io
Wiz for agentless multi-cloud posture management, attack-path graphs and toxic-combination prioritisation, now under Google Cloud.
Penetration Testing
Adversarial testing of approved applications, APIs and exposed services, with evidence, risk context and a remediation retest.
Identity attack paths
Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.