Cloud environments are constantly changing. New users, cloud services, storage locations, and access rights are added on a regular basis. This can lead to unnoticed risks, such as overly broad permissions, publicly accessible storage, or insecure configurations.

A cloud penetration test helps identify these risks early on, before attackers can exploit them.

A cloud penetration test:

• Identifies vulnerabilities before attackers do.
• Checks cloud configurations and access permissions.
• Identifies attack vectors within the cloud environment.
• Protects sensitive data from unauthorized access.
• Provides specific recommendations for improvement.

This will give you insight into the true resilience of your cloud environment.

Among other things, we test:

• Microsoft Azure
• Microsoft 365
• Amazon Web Services (AWS)
• Google Cloud Platform (GCP)
• Hybrid cloud environments
• Multi-cloud environments
• Kubernetes clusters
• Container Platforms
• SaaS, PaaS, and IaaS environments

A new cloud penetration test is recommended:

• For migrations to Azure, AWS, or Google Cloud.
• Following major changes to the cloud environment.
• For new subscriptions or accounts.
• After changes to IAM roles and access rights.
• Periodically, for example, annually.

The results of the penetration test will help you determine when additional or repeat tests are necessary.

Upon completion, you’ll receive an executive summary, a technical report with findings and risk assessments, an overview of recommended improvements, and a consultation with one of our ethical hackers. This will give you immediate insight into the most important cloud risks and next steps.

The duration depends on the size of the cloud environment, the number of accounts, subscriptions, workloads, and cloud services. A cloud penetration test typically takes anywhere from a few days to a few weeks, depending on the scope.

The exact scope varies by organization, but typically includes:

• IAM Roles and User Permissions
• Service Accounts
• MFA Configurations
• API keys and secrets
• Network Configurations
• Firewall Rules
• Security groups
• Storage accounts and buckets
• Databases
• Containers and Kubernetes
• Logging and Monitoring
• CI/CD pipelines
• Cloud Integrations and Connections

Common findings include:

• IAM permissions that are too broad
• Publicly accessible storage
• Insufficient logging
• Open Network Rules
• Expired API keys
• Insecure storage of secrets
• Excessive privileges for service accounts
• Insufficient segmentation between workloads

These vulnerabilities can lead to data breaches, privilege escalation, and unauthorized access to cloud resources.

Cloud providers only do this to a limited extent. Cloud providers such as Microsoft, Amazon, and Google secure the underlying infrastructure. However, organizations remain responsible for managing user permissions, storage, network access, logging, and configurations. This is known as the shared responsibility model.

A cloud penetration test focuses specifically on these customer responsibilities.

Yes. A cloud penetration test provides valuable insights for information security, risk management, and compliance initiatives.

Among other things, the report can contribute to:

• the cybersecurity and risk management requirements set forth in the Cybersecurity Act (NIS2);
• information security standards such as ISO 27001;
• cloud-specific standards such as ISO 27017;
• internal and external security audits;
• Risk assessments for the board and executive management.