Skip to main content

Cloud Infrastructure Assessment (Azure and AWS)

What one set of developer credentials can reach across your Azure or AWS environment, and how it is configured.

Book a Scoping Call

We check how identities, networks, storage and services are configured, then test what an attacker could reach starting from one set of ordinary developer credentials. You get a prioritised fix list your engineers can act on, and a summary your customers, investors or auditors will accept.

Who it is for

  • Software companies running their product on Azure or AWS ahead of an enterprise deal, release or funding round.
  • Organisations that have moved servers and data into the cloud and want to know it was done securely.
  • Managed service and cloud providers who want an independent check of an environment they run for a client.

Scope bands

Fixed scope, fixed fee. Answer four questions, receive a fixed-fee quote, and nothing changes once work starts. Larger or more complex requirements are scoped as a Bespoke engagement, still at a fixed fee agreed before work begins.

Platforms

Focused
Azure or AWS
Core
Azure or AWS
Extended
Both

Subscriptions or accounts

Focused
1
Core
Up to 3
Extended
Up to 5

Applications or systems

Focused
1
Core
Up to 3
Extended
Up to 6

Connected to office or DC

Focused
No
Core
Yes
Extended
Yes

Your highest answer sets the band. One answer in Extended places the engagement in Extended, whatever the other three are.

Bespoke

Containers, infrastructure-as-code review, government cloud or larger estates.

Included with every Enhanced package

  • Full technical report: every finding with severity, business impact, evidence and remediation guidance.
  • Letter of attestation: a forwardable summary for the customer, insurer, investor or auditor who asked for the test.
  • 60-minute debrief for technical and business stakeholders.
  • One retest within 30 days, with a retest report.
  • Immediate escalation of any critical issue found during testing, not held until the report.
  • Independent quality review of every report by a second senior practitioner before issue.

Also included with this package

  • Attack path walkthroughs from developer credentials to sensitive data or control of the environment, where one exists.
  • Prioritised remediation plan.
  • Baseline results against CIS and provider security benchmarks.

How it works

  1. 01Answer the four scoping questions.
  2. 02Receive a fixed-fee quote.
  3. 03Sign authorisation and set up access (some packages include an access guide).
  4. 04We test, issue the report within five business days, run the debrief and complete the retest.

Good to know

Testing is read-only by default. Every finding is manually verified.

Microsoft 365 is covered by the Microsoft 365 Security Assessment. View that service

Exploitability, not a scanner dump

  • Every finding is reproduced by hand before it reaches the report. Anything a tester cannot reproduce is discarded rather than passed on with a caveat.
  • Findings are rated by what an attacker could actually do with them in your environment, not by the raw score a tool assigned.
  • Where a route exists from a starting foothold to something that matters, we show the route rather than listing the steps as separate findings.
  • Every report is independently quality reviewed by a second senior practitioner before it is issued.

Who tests

Testing is led by a UK Cyber Security Council Principal practitioner (Security Testing) holding CREST CRT, OSCP, OSEP and CyberScheme Team Leader. Every report is independently quality reviewed by a second senior practitioner before issue. Our founders bring over ten years each in UK defence and critical national infrastructure. Tarian Labs is Cyber Essentials certified and based in South Wales.

Fixed scope, fixed fee, agreed before work starts.

A short call with a practitioner is enough to size this accurately.

Book a Scoping Call