Cloud security audit
We review how your cloud is actually configured: who can do what, what is reachable from the internet, what is logged and what is encrypted. Read-only access, automated checks against the CIS Foundations Benchmark for your platform, then a manual review of everything a benchmark misses.
Who it is for
- Organizations that moved fast in the cloud and want an independent view of where they stand.
- Teams preparing for ISO 27001, SOC 2 or a regulator, where cloud configuration is in scope.
- Multi-cloud estates that need one consistent standard across providers.
What we assess
- Identity: privileged roles, long-lived keys, multi-factor authentication and paths to privilege escalation.
- Network exposure: services and management ports reachable from the internet.
- Storage: public buckets, shared links and data that should not be reachable.
- Logging and monitoring: whether the activity you would need after an incident is actually recorded and kept.
- Encryption and key management.
- Data residency: whether data that must stay in a given country is hosted in a region there.
What you receive
- Benchmark results with false positives removed.
- Manual findings ranked by real-world risk, each naming the exact setting or policy to change.
- A short executive summary and a re-test once fixes are in.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one to two weeks per platform, depending on the number of accounts, subscriptions or tenancies.
Common questions
Do you need admin access?
No. We use a read-only auditor role, send you the exact permissions in advance, and you revoke them when fieldwork ends.
Will the audit affect production?
No. We make read-only API calls and change nothing.
Is a cloud security posture tool not enough?
Tools list misconfigurations. We work out which ones matter in your environment, remove false positives, find the identity paths a tool does not join up, and write the fix for each finding.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Cloud security audit
We reply within one business day.
Nothing you send is shared outside Calibre.