Cloud security

Each assessment looks at the same five areas, adapted to the platform: who can sign in and what they can do; which services and ports the internet can reach; where data is stored and who can read it; how keys and secrets are handled; and whether logging would show an attacker using the paths we find. Scope follows the accounts, subscriptions, projects or tenant you name.

A configuration review compares settings with a benchmark and lists what differs. Attack-path testing asks a harder question: starting from a realistic identity, such as a developer role or a leaked key, what could someone actually reach? PoCForge does both, and findings are ranked by what an attacker could reach, not by a benchmark score.

Reviews normally start from read-only access that you create and revoke when the work ends. We do not change settings in your accounts. Any active testing, such as checking that a high-risk path really works, is agreed in writing first, and destructive actions stay out of scope.

Choose a single-provider assessment when most workloads sit in one cloud. Choose multi-cloud when you run two or more and identities or networks connect them, because the riskiest paths often cross that boundary. Microsoft 365 is assessed on its own, or with Azure in the Microsoft Cloud Readiness Assessment, because the tenant holds identity, email and files.

An executive summary for non-specialists, technical findings with evidence and steps to reproduce, severity based on what a realistic identity could reach, and remediation guidance for the owning team. Fixes that are ready within 6 months of the original test are retested (up to 10 issues), with an updated closure note.