What is a cloud penetration test?
A cloud penetration test assesses your cloud environment — AWS, Azure or GCP — from two angles: what an external attacker can reach and abuse, and what an attacker who lands inside (a stolen credential, a compromised workload) can escalate to. The vast majority of real cloud incidents come down to identity and configuration, so that's where we focus.
What we test
- Identity & access management. Over-privileged users and roles, privilege-escalation paths, cross-account trust, and the service account nobody has rotated since launch.
- Public exposure. Storage buckets, snapshots, container registries, queues and databases exposed to the internet — directly or through misconfigured policies.
- Network controls. Security groups, peering, private endpoints, and the flat internal networks that turn one compromised instance into all of them.
- Workload & secrets hygiene. Instance metadata abuse, secrets in user data and environment variables, container escape paths and CI/CD pipeline exposure.
- Assumed breach. Starting from a low-privileged credential, how far can we get? This is the test that tells you what a phished employee actually costs.
How an engagement runs
Free scoping call, fixed quote within one business day. Most cloud engagements run 4–8 testing days depending on the number of accounts and services in scope. We work read-only by default with exploitation by agreement, and we never test outside the rules of engagement — cloud provider policies are respected throughout.
Cloud testing pairs naturally with an external network penetration test for full perimeter coverage, or a web application test when your product runs on the environment under review.
FAQ
Frequently asked questions
How much does a cloud penetration test cost?
Most cloud engagements run 4–8 testing days, typically between AU$6,000 and AU$14,000 depending on the number of accounts, subscriptions or projects in scope. Fixed quote within one business day of a scoping call.
Do we need permission from AWS, Azure or Google to be tested?
Generally no. All three major providers permit customer-authorised security testing of your own workloads under their acceptable use policies, without prior approval for standard testing. We stay within those policies and handle any edge cases during scoping.
What access do you need?
For configuration review we typically use a read-only (SecurityAudit-style) role you provision for the engagement. For assumed-breach testing we use a deliberately low-privileged identity you create. You can revoke everything the moment testing ends.
Is this just running a cloud security tool over our account?
No. Automated cloud posture tools are useful and we do use tooling for breadth — but the findings that matter come from manually tracing privilege-escalation chains, validating what exposed resources actually contain, and proving impact. A tool tells you a role is over-privileged; we show you the path from intern credentials to production data.
Can you test multi-cloud or hybrid environments?
Yes. We test AWS, Azure and GCP, including environments that span more than one provider plus on-premises infrastructure. Scope is agreed per account/subscription/project so the quote stays predictable.
Contact
Talk to us
Tell us what you're trying to protect, secure or build. We'll come back with a plan.
Time to check your cloud?
Drop your email and we'll come back with a plan within one business day.