Cloud and Identity

Prove which cloud paths lead to admin.

We review AWS, Azure, GCP and your identity provider as an attacker with a low-privilege foothold. Every path we report has been walked and confirmed by hand.

From foothold to admin.

Five steps from a low-privilege account to the path that matters.

  1. Start low

    We begin as a low-privilege identity, the way an attacker usually does.

  2. Walk the graph

    IAM, Entra ID and Active Directory paths are mapped toward privileged roles.

  3. Pull the secrets

    Pipelines, stores and runtimes are checked for credentials that open the next hop.

  4. Reach admin

    The path is proven end to end, with configuration evidence behind each hop.

  5. Fix in order

    You get the graph, a ranked fix list and a retest when the fixes land.

What this engagement covers

When you need it

  • After a migration
  • After an IAM redesign
  • Before an audit

What we test

  • IAM privilege escalation
  • Entra ID and Active Directory attack paths
  • Secrets and CI/CD
  • Network exposure
  • Logging gaps

What you get

  • An attack-path graph
  • Prioritized fixes
  • Configuration evidence
  • A readout
  • A retest of fixed findings

How it runs

  • Duration: Most Assess engagements run two to four weeks from kickoff to readout.
  • What we need from you: A named decision owner, a low-privilege foothold account and, where available, architecture notes for the accounts in scope.

Standards

  • CIS Benchmarks
  • MITRE ATT&CK Cloud

Frequently Asked Questions

Which clouds do you cover?
AWS, Azure and GCP, plus the identity provider that fronts them, including Entra ID and Active Directory attack paths.
Where does the test start?
From a low-privilege foothold, the position an attacker holds after one compromised account. Every path we report has been walked and confirmed by hand.
Is this a configuration review?
Configuration evidence is part of what you get, but the result is an attack-path graph of what a low-privilege account reaches, with the fixes prioritized.

How We Work

Eight steps from the first call to the closure letter. Every engagement follows them.

  1. Scoping call
  2. Rules of engagement
  3. Threat model
  4. Execution
  5. Analysis
  6. Readout
  7. Remediation support
  8. Retest
Read the full lifecycle

Ready to scope an engagement?

Tell us the asset and the decision the test should inform.

Scope a call