Overview
Whether you host in AWS London, Azure UK South or a multi-cloud estate, attackers look for over-privileged identities, exposed storage and weak network controls. We test those paths, aligned with the cloud providers' own testing policies and the NCSC's cloud security principles.
Most cloud breaches don't involve exotic exploits. They start with an over-permissive role, a leaked access key in a repository, a publicly readable storage bucket or a compromised CI/CD runner — and move quickly from there.
Our cloud penetration tests combine a configuration review against recognised benchmarks with hands-on exploitation. Starting from realistic footholds — an external attacker, a compromised developer credential or a vulnerable workload — we map how far an attacker could get and which data they could reach.
The result is a prioritised view of the attack paths that matter, not a list of thousands of low-value configuration warnings.
How testing works for UK organisations
- Signed scope and written authorisation before any testing, in line with the Computer Misuse Act 1990
- Testing windows agreed in UK time, including out-of-hours windows for production systems
- Fully remote delivery, with internal and wireless access via VPN or a posted test device, so there are no travel costs
- Reports mapped to ISO 27001, PCI DSS, UK GDPR Article 32 and customer questionnaires, with a fixed price in GBP
What's included
Our approach
- Read-only access & inventoryWe review configuration with read-only credentials and build an asset and identity map.
- Benchmark reviewSettings are compared against CIS benchmarks and provider best practice.
- Attack path analysisWe identify privilege-escalation and lateral-movement paths through IAM and services.
- Exploitation (agreed scope)Selected paths are safely exploited to prove impact.
- Report & hardening planPrioritised fixes, infrastructure-as-code recommendations and a retest.
What you receive
- Attack path narratives with evidence
- CIS benchmark gap summary
- IAM least-privilege recommendations
- Infrastructure-as-code fix guidance
- Retest report and attestation letter
Standards & frameworks
- CIS Benchmarks
- AWS Well-Architected (Security)
- Microsoft cloud security benchmark
- MITRE ATT&CK Cloud
- ISO 27017
- SOC 2
- NCSC penetration testing guidance
Frequently asked questions
Do we need permission from our cloud provider?
AWS, Azure and Google Cloud permit customers to test their own resources for most services without prior approval, subject to their published policies. We review the current policy with you during scoping.
Is a configuration review the same as a cloud pentest?
No. A review checks settings against benchmarks; a penetration test also proves exploitability by following attack paths to sensitive data.
Can you test multi-account or multi-cloud environments?
Yes. We scope by accounts, subscriptions or projects and prioritise production and identity-critical environments.
Are you CREST or CHECK accredited?
We don't claim CREST or NCSC CHECK status on this site. Most private-sector tests, including those for ISO 27001, PCI DSS and customer due diligence, don't require either. If a contract, public-sector buyer or regulator specifically requires a CHECK or CREST-accredited provider, tell us at scoping and we'll tell you honestly whether we can meet it. See our CREST and CHECK guide.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.