Security services · Cloud

Cloud security for AWS, Azure and Google Cloud.

Most cloud breaches need no clever hacking: a storage bucket left public, a key pushed to a code repository, an account with far more power than it needs. We find those mistakes across your cloud accounts, help you fix them, and alert you when new ones appear.

Get a fixed-price quote
AWS, Azure and Google CloudRead-only access to startFix scripts, not just findings
cloud review · sample● demo
  1. FOUND Storage bucket readable by anyone
  2. FOUND Access key unused for 400 days, still active
  3. FLAGGED Admin role without MFA
  4. FIXED Public snapshot made private
  5. PASSED Audit logging on in every region
In plain words

A cloud security assessment checks how your AWS, Azure or Google Cloud accounts are set up. Cloud providers secure their data centres and hardware; you are responsible for your settings: who can log in, what is public, how data is encrypted and what is logged. We review those settings against the CIS Benchmarks, find the gaps an attacker would use, hand you ready-to-run fixes, and can keep watching for new mistakes.

Duration
2–3 weeks
Benchmarks
CIS · CSA CCM
Access
Read-only
Pricing
Fixed or monthly
Who secures what

The cloud is shared. The settings are yours.

Your cloud provider secures the buildings, the hardware and its own software. What you put on top, and who you let in, is your job, whichever cloud you use.

Shared responsibility in the cloud. For virtual servers, managed services and ready-made apps alike, your data, who can access it and your app settings are always yours to secure. The provider takes on more of the lower layers, from code and operating system down to hardware, as you move from virtual servers to ready-made apps. VIRTUAL SERVERSIaaS · e.g. EC2, Azure VMsMANAGED SERVICESPaaS · e.g. RDS, App ServiceREADY-MADE APPSSaaS · e.g. Microsoft 365Your dataYOUYOUYOUWho can access itYOUYOUYOUApp settings and integrationsYOUYOUYOUApplication codeYOUYOUPROVIDEROperating system and patchesYOUPROVIDERPROVIDERNetwork controlsYOUSHAREDPROVIDERHardware and data centresPROVIDERPROVIDERPROVIDERALWAYS YOURSYou secure itSharedCloud provider secures it
Simplified from the shared responsibility models published by AWS, Microsoft and Google. Exact splits vary by service, so we check yours.
What we check

Where cloud mistakes hide.

  • Identity and access

    Over-powered roles, unused keys, missing MFA and risky trust between accounts.

  • Public exposure

    Storage, databases, snapshots and services open to the internet.

  • Secrets

    Keys and passwords in code, build pipelines and environment variables.

  • Logging and monitoring

    Audit logs switched on, kept long enough and actually watched.

  • Network settings

    Security groups, firewall rules and private endpoints.

  • Encryption and keys

    Data encrypted at rest and in transit, and keys managed properly.

  • Kubernetes and containers

    Cluster settings, container images and runtime permissions.

  • Infrastructure as code

    Terraform, CloudFormation and Bicep reviewed before mistakes ship.

  • Cloud AI services

    Amazon Bedrock, Azure OpenAI and Vertex AI: keys, data and who can use them.

How it usually happens

How a cloud breach really starts.

  1. AttackerA key leaks

    An access key is committed to a public code repository, or left inside a mobile app.

  2. Your systemsThe key has too much power

    It belongs to an old automation account with administrator rights that nobody reviewed.

  3. AttackerBots find it quickly

    Automated scanners search public code for keys around the clock.

  4. Your dataData copied, bills run up

    Customer files are downloaded, and expensive servers are started for crypto-mining on your account.

  5. The fixThe fix

    Secret scanning, short-lived credentials, least-privilege roles and alerts on unusual activity. We check each of these.

How it works

Three weeks to a cleaner cloud.

  1. Week 1

    Account discovery

    Every account, subscription and project, including the forgotten ones.

  2. Weeks 1–2

    Configuration audit

    Automated checks against CIS Benchmarks, plus manual review of the riskiest areas.

  3. Week 2

    Identity review

    Who and what can do what, and the paths an attacker could take to admin.

  4. Week 3

    Remediation

    Fix scripts, guidance and a working session with your engineers.

  5. Optional, monthly

    Monitoring

    Alerts when risky settings reappear, and a monthly posture score.

What you get

Fixes your engineers can run today.

HANULSECCloud security assessment CLIENTSample · SaaS company on AWS SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical2High6Medium11Low9 CIS BENCHMARK · 3 ACCOUNTS SCORE 61 → 88 Sample layout, not client data
  • 01
    Prioritised risk register

    Every finding ranked by how exposed it is and what it would cost you.

  • 02
    Fix scripts and guidance

    Command-line and Terraform snippets, not just advice.

  • 03
    CIS Benchmark scorecard

    Where you stand per account, and how it improves.

  • 04
    Attack-path map

    How an outsider or a leaked key could reach admin, step by step.

  • 05
    Drift alerts

    Optional monthly monitoring for new risky settings.

Who it is for

For teams that moved fast to the cloud.

  • Start-ups and SaaS companies running on AWS, Azure or Google Cloud
  • Teams that moved to the cloud quickly and never reviewed the settings
  • Companies preparing for ISO 27001, SOC 2 or customer security reviews
  • Organisations with many accounts and nobody who knows them all
  • Teams adding cloud AI services such as Bedrock, Azure OpenAI or Vertex AI

Read-only, always

We start with read-only access through a role you create and can delete at any time. We never change your cloud without your approval.

Benchmarks

Checked against open benchmarks.

CIS BenchmarksSecure configuration
ISO/IEC 27001Information security
SOC 2Trust Services Criteria
PCI DSS v4.0Card data security
NIST CSF 2.0Govern to recover

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What does a cloud security assessment include?
A review of identity and access, public exposure, secrets, logging, network settings, encryption, Kubernetes and infrastructure code in your AWS, Azure or Google Cloud accounts, checked against the CIS Benchmarks, with a ranked fix list and scripts.
Q02Isn’t the cloud provider responsible for security?
Only partly. Under the shared responsibility model, the provider secures its data centres, hardware and core services. Your data, who can access it and how your services are configured are always your responsibility.
Q03Do you need admin access?
No. We use a read-only role that you create and can remove at any time. Fixes are applied by your team, or by us only with your written approval.
Q04What is a CIS Benchmark?
A free, consensus-based guide from the Center for Internet Security on how to configure a system securely. CIS publishes benchmarks for AWS, Azure, Google Cloud, Kubernetes and more, and they are widely used as a baseline.
Q05Do you review Kubernetes and Terraform?
Yes. We review cluster settings, container images and permissions, and infrastructure-as-code such as Terraform, CloudFormation and Bicep, so mistakes are caught before they are deployed.
Q06How is it priced?
A fixed fee for a one-off assessment, based on the number of accounts and services, or a monthly fee for continuous monitoring.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings