Cloud Penetration Testing and Cloud Security Review
Senior testers perform the cloud penetration test on AWS, Azure or GCP, covering IAM policies, storage, network controls and logging.
What is reviewed and why it matters
From IAM permissions to storage exposure, assessed against provider-specific benchmarks.
Cloud environments change faster than on-premises infrastructure. New services are provisioned through automation, IAM roles accumulate permissions over time, and storage buckets are created for temporary purposes and never removed. Configuration drift is difficult to detect without a structured review against recognised benchmarks. A cloud security review evaluates the entire control plane, covering identity, network, storage, encryption, and monitoring, and identifies the misconfigurations that automated compliance tools frequently miss.
Who needs this assessment
Organisations that host workloads in public cloud environments.
This assessment is designed for organisations that rely on AWS, Azure, or GCP for production workloads and need independent validation that their cloud configuration meets recognised security benchmarks.
Organisations hosting workloads on AWS, Azure, or GCP
Companies in the process of migrating from on-premises to cloud infrastructure
Organisations operating multi-cloud or hybrid cloud architectures
Teams relying on Infrastructure-as-Code deployments (Terraform, ARM, Bicep)
Organisations preparing for ISO 27017 or ISO 27001 certification covering cloud environments
Healthcare organisations and government agencies hosting regulated workloads on cloud infrastructure and subject to NIS2 or sector-specific cloud security requirements
Where these assessments are relevant
- Financial services: customer portals, payment processing, and cloud-hosted transaction infrastructure.
- SaaS and technology: application validation before production deployment or enterprise procurement.
- Healthcare: digital systems handling patient data, clinical records, and connected medical devices.
- Retail and e-commerce: web applications processing transactions, customer accounts, and payment data.
What the assessment produces
The insight and evidence delivered at the conclusion of the assessment.
Every assessment concludes with a structured report covering cloud misconfigurations, severity ratings, evidence, and remediation guidance. Reports are delivered through the Pentrox Portal and are available for download at any time.
- A prioritised list of cloud misconfigurations mapped to CIS Benchmark controls
- Identification of overly permissive IAM roles, trust policies, and cross-account access
- Validation of encryption, key management, and secrets handling
- Governance recommendations for logging retention, alerting, and drift detection
- Portal access with real-time findings, retest workflow, and report downloads for the lifetime of the client account
How an assessment runs
- Scope and Intake
- Planning
- Assessment
- Reporting
- Findings & Retest
Retesting of remediated findings is included as standard with every assessment.
Assessment methodology
Five phases from scoping through verified remediation.
Each phase builds on the previous one. Automated benchmark scanning surfaces known misconfigurations, manual review provides context-specific findings, and quality review ensures every reported issue is documented with actionable remediation.
Scoping and access provisioning
Accounts, subscriptions, or projects in scope are confirmed. Read-only console access is provisioned. The assessment approach is agreed based on access level.
CIS Benchmarks (Scoping), NIST SP 800-53 (Access Control)Automated configuration scanning
ScoutSuite scans configurations against provider-specific CIS Benchmarks. Results cover IAM, storage, networking, logging, and encryption across all regions.
CIS AWS/Azure/GCP Foundations Benchmarks, CSA CCMManual IAM and access review
IAM policies, roles, and trust relationships are reviewed for excessive permissions. RBAC and PIM settings are evaluated for privilege escalation paths.
NIST SP 800-53 (Identity and Access Management), CIS Benchmarks (IAM)Storage, network, and encryption review
Storage services are checked for public exposure and missing encryption. Security groups and VPC/VNet configurations are evaluated against provider baselines.
CIS Benchmarks (Storage, Networking), CSA CCM (Encryption and Key Management)Reporting and quality review
Each misconfiguration is documented with the affected resource, violated benchmark control, and the remediation. Reports undergo quality review before delivery.
OWASP Risk Rating Methodology (severity rating), CIS Benchmarks (Reporting)Scope and deliverables
What is included, what is excluded, and what is delivered.
The statement of work defines the exact cloud accounts, services, and review approach before the assessment begins. The lists below reflect the standard scope for a cloud security review.
In scope
- IAM policies, roles, trust relationships, and access key hygiene
- Storage services (S3, Blob Storage, Cloud Storage) exposure and encryption
- Network configuration (VPC/VNet, security groups, firewall rules, peering)
- Compute configuration (instance metadata, hardening, patching)
- Encryption at rest and in transit, key management, and secrets handling
- Audit logging retention, monitoring, and alerting configuration
- Infrastructure-as-Code alignment (Terraform, ARM, Bicep) where applicable
- Serverless and container security configuration where applicable
Out of scope
- Application-layer testing of workloads running on cloud infrastructure (covered under Web and API Penetration Testing)
- Penetration testing of underlying cloud provider infrastructure
- Cost optimisation review
- Migration planning or architecture design
What you receive
- Executive summary Severity distribution, cloud security posture overview, and remediation priorities written for leadership.
- Detailed findings Each misconfiguration documented with the CIS Benchmark control it violates, evidence, and remediation steps.
- Technical conclusion IAM privilege escalation paths, governance gaps, and structural recommendations beyond individual fixes.
- Scope and strategy description Goals, test approach, and scope boundaries for audit traceability.
- Portal access Real-time findings, report downloads, retest workflow, and team management through a dedicated platform.
- Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
- Retest report Verification results after remediation, documenting each finding with its updated status.
Read more
Cloud misconfigurations that keep appearing
The misconfigurations found again and again in AWS, Azure and GCP.
Retesting: how a fix is proven
What a retest checks, the three outcomes, and why the record matters in an audit.
Azure and Entra ID penetration testing
For Microsoft environments; conditional access, roles, app registrations and Microsoft 365 tested by senior testers.
When independent assessment is the right step
An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.
Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.
Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.
Timeline
Illustrative durations to support planning. Confirmed in the statement of work.
The duration of a cloud security review depends on the number of cloud accounts, the services provisioned, and whether Infrastructure-as-Code review is included. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.
What determines duration
- Number of cloud accounts, subscriptions, or projects in scope
- Number and variety of cloud services provisioned across regions
- Complexity of IAM configuration and cross-account trust relationships
- Whether Infrastructure-as-Code review (Terraform, ARM, Bicep) is included
- Whether serverless and container environments are in scope
Actual duration is confirmed during scoping and depends on the number of accounts and services provisioned. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after the review completes.
Why Pentrox
The operational standards behind every cloud security review.
These operational standards apply to every cloud security review Pentrox delivers, regardless of provider or environment size.
Multi-cloud coverage
AWS, Azure, and GCP assessed against provider-specific benchmarks.
Each environment is evaluated against the CIS Benchmark for that provider. Findings are actionable within the correct management console and tooling.
Manual IAM deep dive
Permissions reviewed by hand, not only by automation.
Trust chains, cross-account relationships, and conditional access logic are manually reviewed. The analysis identifies privilege escalation paths that automated tools do not detect.
Infrastructure-as-Code alignment
Configuration reviewed against the templates that created it.
Where Terraform, ARM, or Bicep templates are provided, findings are mapped back to the source. Remediation is applied at the code level to prevent drift.
Direct access to the tester
No account managers between the client and the security expert.
Critical or blocking findings are escalated immediately through the channel agreed at kickoff. Remediation can begin before the final report is delivered.
Portal-delivered results
Findings visible in real time through the Pentrox Portal.
The Pentrox Portal provides remediation tracking, retest requests, report downloads, and team access management. Two-factor authentication and role-based access control are enforced on every account.
Frequently asked questions
Practical answers for security teams and procurement officers.
Which cloud providers are supported?
The assessment covers AWS, Azure, and GCP. Multi-cloud environments with workloads spread across providers are assessed as a single review with findings mapped to the relevant provider benchmark.
What level of access is required?
Read-only access to the cloud management console is the standard requirement. The specific role or policy needed is agreed during scoping and documented in the statement of work. No write permissions are requested.
Is retesting included, and at what cost?
Retesting of remediated findings is included as standard with every assessment. There are no additional charges. The client flags remediated findings through the Pentrox Portal and submits a retest request. Results are published through the Portal once the verification is complete.
Can this report be used as audit evidence for ISO 27017 or ISO 27001?
The report is structured for audit traceability, with findings mapped to CIS Benchmark controls, a clear scope description, severity ratings, and remediation status per finding. It is worth noting that the report documents the technical review; it does not replace the certification audit itself.
Does the review include serverless and container environments?
Serverless function configurations and container orchestration settings (including managed Kubernetes services) are included in scope when they are present in the assessed environment. The scope is confirmed during the intake phase.
Is reporting available in Dutch?
Reports are delivered in English by default. Dutch-language reporting can be arranged when required. The statement of work confirms the reporting language before the assessment begins.
How is assessment data handled and who has access to findings?
Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.
What happens when a critical misconfiguration is found during the review?
Critical or blocking findings are communicated immediately through the channel agreed at kickoff. Findings are published in the Pentrox Portal as they are confirmed, so remediation can begin before the final report is delivered. The escalation path is documented in the statement of work.
Related assessment categories
Compliance and Standards
ISO 27001, NIS2, PCI-DSS, and DigiD assessments against a defined control framework.
Advanced Testing
Scenario-based assessments, red team exercises, mystery guest, and phishing simulations.
Pentest as a Service (PTaaS)
A continuous subscription covering recurring assessments across an agreed annual day allocation.