Cloud configured wrongis a breach waiting.

We use read-only access scoped to security-relevant APIs. The assessment is passive — we analyze configuration, not traffic. No production workloads are touched. The assessment typically completes in 3–5 business days and produces a written report with severity-ranked findings.

Overly permissive IAM — roles with admin access used for application workloads, long-lived access keys in CI/CD, and no MFA on root/admin accounts. A close second is public S3 buckets containing sensitive data. Both are configuration errors, not sophisticated attacks — and both are preventable.

Start with a gap assessment — we map your current cloud controls against SOC 2 Trust Service Criteria and identify what's missing. Cloud controls cover a significant portion of SOC 2 requirements (logging, encryption, access control, change management). We implement the technical controls; your compliance team or a third-party auditor handles the audit itself.

For clients on managed plans: on-call response within 15 minutes, containment as first priority (isolate affected resources), investigation, and remediation. For project engagements: incident response consulting on a time-and-materials basis. We've handled S3 data exposures, compromised access keys, and malware in container images.

The standard cloud security assessment is configuration-focused — CIS benchmark scanning, IAM audit, and network review against your live setup. Penetration testing (simulated attacks against your applications and network) is a separate engagement we coordinate, often with a specialized third-party firm so the test is independent. For most clients we recommend the config assessment first, since the majority of breaches start from misconfiguration, not exploited code.

Technical cloud controls — logging, encryption, access control, change management — typically take 4-6 weeks to implement after the gap assessment. That covers a large portion of SOC 2 Trust Service Criteria and HIPAA technical safeguards. The full certification timeline depends on your auditor and observation period (SOC 2 Type II requires several months of evidence), but we get the cloud side audit-ready quickly and automate evidence collection via Config rules and CloudTrail.

The read-only CIS-benchmark assessment with a severity-ranked written report is a fixed fee, typically in the low five figures depending on account count and cloud providers in scope. Remediation implementation (IAM rebuild, network hardening, detective controls) is scoped separately over a 4-6 week window. Ongoing monitoring with quarterly pen-test coordination is available as a monthly retainer for teams that want continuous coverage.