Service
Penetration testing
Authorized testing of apps, APIs, and networks
Service
Cloud and application security reviews that catch risk early
A practitioner review of how your cloud environment and applications are designed and configured (identity, network exposure, data protection, logging, and secure design), with prioritized fixes your engineers can apply.
What we deliver
Cloud and application security reviews covering architecture, configuration, identity, logging, and secure design.
- References
- NIST CSF 2.0
- Pricing
- Published starting price
Who it's for
A good fit for
- SaaS teams running production workloads in one or more public clouds
- Engineering leaders whose cloud environment grew quickly and who want an outside review of it
- Teams planning a major architecture change, migration, or new product that want design input early
- Organizations facing customer security reviews with detailed cloud and application questions
Not the right fit for
- Organizations that want active exploitation of their systems, which is penetration testing
- Teams looking for an ongoing managed cloud security or monitoring service
- Organizations with no cloud footprint and no applications of their own
Problems it addresses
- Access to cloud accounts has grown over time, and no one is sure who can do what.
- Storage, databases, or services may be exposed to the internet by accident.
- Logs exist, but they wouldn't answer basic questions after an incident.
- Security gets reviewed at the end of development, when changes are expensive.
- Secrets, keys, and credentials are scattered across code, pipelines, and configuration.
Scope
Included
- Architecture review of how workloads, data stores, networks, and third-party services connect
- Identity and access review: administrative access, roles, service accounts, federation, and multi-factor coverage
- Configuration review against recognized baselines for the cloud services you use
- Logging and monitoring coverage: what's collected, where it's kept, and whether it would support an investigation
- Data protection: encryption, key management, backups, and exposure of storage and databases
- Secure design review of selected applications, including authentication, authorization, secrets handling, and build and deployment pipelines
Not included
- Active exploitation or penetration testing (scoped separately)
- Making configuration changes in your environment
- Line-by-line source code review of entire codebases
- Ongoing monitoring or managed security services
Deliverables
- Findings report prioritized by risk and effort, with specific remediation steps
- Architecture notes and diagrams that highlight trust boundaries and key risks
- Identity and access summary showing privileged access and recommended changes
- Logging coverage summary with recommended additions
- Walkthrough of findings and fixes with your engineers
How the engagement runs
Every engagement begins with a written scope and proposal.
Scope
We agree on the cloud accounts, applications, and depth of review, and document them in a written scope.
Access and discovery
You grant read-only access or provide exports, and we review architecture documents and talk with the engineers who run the environment.
Review
We examine identity, configuration, logging, data protection, and application design against the agreed baselines.
Report and walk through
We deliver prioritized findings and walk your engineers through them, including which fixes to tackle first.
Standards and methods
- CIS Benchmarks for cloud-service and workload configuration baselines
- OWASP Application Security Verification Standard (ASVS) 5.0.0 for application security requirements
- NIST CSF 2.0 outcomes for identity and access, data security, and continuous monitoring
Configuration baselines and secure design
Two vendor-neutral references anchor a cloud and application review, so each finding points to a published expectation rather than a reviewer's preference.
CIS Benchmarks are prescriptive configuration recommendations for more than 25 vendor product families, including operating systems, cloud providers, network devices, and databases. They're the product of a consensus-based effort by cybersecurity experts, and they give configuration findings a specific, citable reference point.
The OWASP Application Security Verification Standard (ASVS), at version 5.0.0 when checked on 2026-09-27, provides a basis for testing web application technical security controls and gives developers a list of requirements for secure development.
The two complement each other: benchmarks describe how platforms should be configured, and the ASVS describes how the application itself should behave. A design-stage review can use the ASVS as a checklist of requirements before any code is written.
Sources: CIS Benchmarks; OWASP Application Security Verification Standard (ASVS)
Prerequisites and your responsibilities
- Read-only access to the cloud accounts in scope, or configuration exports if outside access isn't allowed
- Architecture diagrams, or a walkthrough from an engineer who knows the environment
- Engineers who can answer questions about design decisions during the review
- A list of the applications and environments in scope, with an owner for each
Pricing
Cloud Security Review
From $7,500
Typical scoped range: $7,500 to $18,000
One-time project
Non-binding. Final pricing follows a written scope and proposal.
What affects the final price
Pricing depends on environment size, complexity, testing depth, locations, applications, accounts, user roles, compliance objectives, and delivery timeline. Every engagement begins with a written scope and proposal. Taxes, travel, remediation, third-party audit or certification fees, licensing, and emergency work are separate. Readiness services do not include independent certification, attestation, legal advice, or a guarantee of passing.
Guides
- Compliance · 11 min readWhich PCI DSS SAQ do you need? SAQ types and scopeWhich PCI DSS Self-Assessment Questionnaire fits your payment setup: SAQ A, A-EP, B, B-IP, C, C-VT, P2PE, SPoC and D, who decides, and how scope drives it.
- Compliance · 10 min readPCI DSS 6.4.3 and 11.6.1: payment page script securityPCI DSS requirements 6.4.3 and 11.6.1 in plain terms: payment page script inventory, authorization and integrity, tamper detection, and SAQ A eligibility.
- Testing · 5 min readHow to scope a penetration test you can act onHow to scope a penetration test you can act on: the question to answer, written authorization, targets and exclusions, rules of engagement and retest.
Frequently asked questions
What access do you need?
Read-only access is usually enough. During scoping we list the permissions we need, so your team can create a dedicated, time-limited role and remove it when the review ends. If your policies don't allow outside access, configuration exports and guided screen-sharing work too.
How is this different from a penetration test?
A cloud and application review looks at how things are built and configured, and often finds issues a tester wouldn't reach within a fixed testing window. A penetration test tries to exploit weaknesses from an attacker's point of view. The two complement each other, and a review is often a useful first step.
Do you review infrastructure as code?
Yes, when it's in scope. Reviewing templates and modules can catch problems before they're deployed, and it helps fixes last because changes go into the code rather than being made by hand.
Can you review an application that's still being designed?
Yes. Design-stage reviews often cost the least to act on, because changing a diagram is cheaper than changing production. We review the proposed architecture, data flows, and identity model, and recommend changes before build work starts.
Talk to a practitioner about a cloud or application review
Share what’s prompting the work and what you need to decide, and we’ll help you judge whether this service is the right fit.
What happens next
- Tell us about your environment and what's driving the request.
- Talk through goals, constraints, and options with a practitioner.
- Review the proposal and decide whether to go ahead.