Cloud penetration testing for identity-first attacks.
Cloud security testing across AWS, Microsoft Azure, Google Cloud and Microsoft 365 — finding the identity, configuration and exposure weaknesses attackers use to take over cloud environments.
In the cloud, identity is the new perimeter.
Cloud breaches rarely start with a software exploit. They start with stolen credentials, an over-privileged role or a storage bucket that should never have been public — and spread quickly through permissions nobody fully understands.
Our cloud penetration testing combines configuration review with attack-path testing: not just what is misconfigured, but what an attacker could actually do with it.
Identity, configuration and exposure.
We test within each cloud provider’s penetration testing policy.
Identity & access management
Roles, policies, trust relationships and federation across accounts and tenants.
Privilege escalation paths
Routes from a low-privileged identity to administrative control.
Entra ID & Microsoft 365
Conditional access, MFA coverage, app consent and tenant configuration.
Storage & data exposure
Publicly accessible storage, snapshots and databases.
Network controls
Security groups, firewalls and exposure of management interfaces.
Secrets management
Keys, tokens and credentials in code, configuration and metadata services.
Compute & containers
Virtual machines, serverless functions and managed container platforms.
CI/CD pipelines
Build and deployment pipelines that can be abused to reach production.
Logging & monitoring
Whether attacks would be logged and detected.
How we test.
AI-assisted speed for the repetitive work. Senior, manual testing for judgement, exploitation and evidence.
Scope
Agree accounts, subscriptions, projects and access.
Review
Configuration review against recognised benchmarks.
Map paths
Identify identity and privilege escalation paths.
Exploit & verify
Safely demonstrate attack paths and impact.
Report & retest
Prioritised fixes and revalidation.
Choose the right starting point.
Configuration review
Read-only review of your cloud configuration against best practice and benchmarks.
Attack-path testing
Starting from a compromised identity or workload, testing how far an attacker could go.
Microsoft 365 tenant review
Identity, email and collaboration security — see our Microsoft 365 guide.
Fixed price, agreed before testing starts.
Penetration tests are priced per consultant day at £795 + VAT per consultant day. You get a fixed price in a statement of work after a short scoping call — no hidden day rates.
Typically 2–5 days depending on the number of accounts and services. Multi-cloud and large estates are quoted individually.
- Senior, hands-on testing by the person who scopes it
- Live findings on the client platform
- Report with executive summary and remediation
- Retest terms agreed up front
Evidence you can act on — and share.
Executive summary
Plain-English risk, business impact and priorities for leadership and boards.
Attack paths
How individual weaknesses chain together into real-world impact.
Technical findings
Evidence, CVSS scoring and specific, practical remediation for every finding.
Live findings
Findings published to the SMARTSEC client platform as the engagement runs.
Retest
Independent revalidation of fixes, with retest terms agreed in the statement of work.
Debrief
A walkthrough of the results with your technical team and stakeholders.
What we typically find.
Examples of the issue types this kind of test regularly uncovers — illustrative, not client data.
- Over-privileged roles enabling privilege escalation
- Publicly accessible storage buckets or snapshots
- Long-lived access keys and secrets in code or pipelines
- Gaps in conditional access and MFA coverage
- Management interfaces exposed to the internet
- Cross-account trust relationships that are too broad
- Illicit application consent in Microsoft 365
- Insufficient logging to detect attacker activity
Evidence for the people who ask.
- Client and partner due diligence — independent evidence that your cloud environment is configured securely.
- ISO 27001 and SOC 2 — cloud security testing is commonly expected as part of assurance.
- DORA — testing of ICT systems supporting critical or important functions, many of which now run in the cloud.
- Shared responsibility — your provider secures the cloud; you are responsible for how you configure and use it.
Cloud questions.
What is cloud penetration testing?
Security testing of your cloud environment — identity, configuration, exposed services and workloads — to find how an attacker could gain access, escalate privileges and reach your data.
Do we need permission from AWS, Azure or Google?
Major providers allow customers to test their own resources within published penetration testing policies, without prior approval for most activities. We test within those policies.
What access do you need?
Usually read-only access for configuration review, and an agreed starting identity or workload for attack-path testing.
Do you test Microsoft 365?
Yes. Microsoft 365 and Entra ID tenant security is one of the most valuable areas to test, particularly against business email compromise.
Can you test multi-cloud environments?
Yes. We can test across AWS, Azure and Google Cloud, including the identity links between them.
Is cloud testing disruptive?
Configuration review is read-only. Attack-path testing is planned and agreed in advance to avoid disruption.
Need your cloud environment tested?
Tell us about your providers, accounts and what you want to know — we’ll confirm scope and a fixed price.