Cloud penetration testing for AWS, Azure and Google Cloud

Manual testing of your cloud-hosted workloads, applications and services, combined with a review of your cloud configuration against CIS benchmarks. Individually scoped, with a fixed price agreed before testing begins. Exploitr is a CREST member company, with penetration testing accreditation.
Get a Quote Book a Scoping Call

Accreditations and memberships

CREST member company, accredited for penetration testing CREST-accredited penetration testing Cyber Essentials certified UK Cyber Security Council member

Cloud Security Testing

What our cloud testing covers

Cloud security follows a shared-responsibility model. Your cloud provider secures parts of the underlying infrastructure, while your responsibilities depend on the services you use and how you configure them. Our testing focuses on your in-scope cloud environment, including its workloads, exposed services and security configuration.

A cloud environment changes whenever someone deploys a service, opens a port or changes a setting. Testing shows you what an attacker could reach and exploit today, and the benchmark review shows where your configuration differs from a recognised baseline.

Typical cloud attack surface

  • Virtual machines & containers
  • Web applications & APIs
  • Storage & databases
  • Network & firewall rules
  • Account & access settings

Why test the cloud?

Cloud services are quick to deploy and easy to expose by accident. A penetration test shows what is reachable and exploitable, and the benchmark review shows which settings to correct.

Who Needs This

Who needs cloud penetration testing?

Any organisation running production workloads or customer data in AWS, Azure or Google Cloud.
Get a Cloud Pentest Quote

Teams that built or migrated quickly

Fast builds and migrations are when settings are left open or inconsistent. Testing after a migration or a major build gives you a picture of what was left exposed.

Organisations with cloud in their compliance scope

If your cardholder data environment or your ISMS boundary includes cloud-hosted systems, those systems need to be part of the testing. See our guidance on penetration testing for compliance.

Suppliers answering customer security reviews

Enterprise buyers ask where your product is hosted and whether that environment has been tested. See penetration testing for customer security reviews.

Scope & Coverage

What cloud penetration testing covers

Scope depends on what you run in the cloud, and we confirm it during scoping. We cover AWS, Azure and Google Cloud. These are the areas we typically assess.

  • Internet-facing infrastructure

    Virtual machines, containers, gateways, management interfaces and other exposed services, assessed from the position of an external attacker. See our external penetration testing service for the full approach.

  • Web applications and APIs

    Applications and APIs hosted in the cloud, tested to the same standard as on-premise ones. See our web application and API penetration testing services.

  • Storage and data exposure

    Publicly reachable storage, databases and other services that could expose data, and the settings that control who can reach them.

  • Network exposure

    Firewall rules, security groups and network settings that decide what is reachable from the internet and between environments.

  • Configuration against CIS benchmarks

    A review of the accounts, subscriptions or projects in scope against the CIS benchmark for AWS, Azure or Google Cloud, and of virtual machine operating systems against the relevant CIS benchmark. The benchmarks cover areas such as identity and access settings, logging, monitoring, networking and storage. For servers, workstations and firewalls outside the cloud, see our configuration review service.

Our Methodology

How we conduct cloud penetration testing

Cloud testing combines hands-on testing of what you run with a structured review of how it is configured, and reports both in one place.
01

Scoping & Rules of Engagement

We agree the providers, accounts, subscriptions or projects, workloads and testing boundaries with you before any active work begins, along with testing windows, excluded systems and acceptable techniques. For the benchmark review we need a read-only role in each account, subscription or project in scope, and for the penetration testing we need test accounts for the workloads and applications.
02

Discovery

We map the assets in scope, identify exposed services and establish how the environment can be reached from an attacker's perspective. This informs the testing plan and helps us focus on the most relevant attack paths.
03

Penetration Testing

Manual testing of the workloads, applications and services in scope, with controlled exploitation to confirm real impact.
04

CIS Benchmark Review

We review the in-scope accounts, subscriptions or projects against the relevant CIS benchmark and report where your configuration differs from it.
05

Reporting & Debrief

Findings are documented with reproduction steps, severity scoring and remediation guidance, with an executive summary alongside the technical detail. A debrief call follows the report.

Pricing

Cloud testing is scoped individually

Cloud environments vary too much for a published from-price, so we scope each one and agree a fixed price before testing starts. Tell us the following in your quote request and we'll reply within one business day to confirm the scope, then send a fixed-price proposal. See the pricing guide for our other services.

  • Your cloud providers

    AWS, Azure, Google Cloud, or a mix, and how many accounts, subscriptions or projects are in scope.

  • What runs in them

    The workloads, applications and APIs you want tested, and anything that should be excluded.

  • Your context

    Any compliance driver, customer review or deadline behind the testing.

Ready to scope your cloud penetration test?

You don't need to prepare a detailed scope document. Tell us which cloud providers you use, what you want tested and why, and we'll help define the engagement.
Book a Scoping Call

Common Questions

Cloud penetration testing: frequently asked questions

We scope cloud testing individually and agree a fixed price before testing starts. The number of accounts, subscriptions or projects and the workloads in scope drive the effort.

Our penetration testing pricing guide compares costs across the services we publish prices for.

We test AWS, Azure and Google Cloud.

The Center for Internet Security (CIS) publishes configuration benchmarks for the major cloud providers. We review your accounts, subscriptions or projects against the CIS Foundations Benchmark for AWS, Azure or Google Cloud, and the operating systems of your virtual machines against the relevant CIS benchmark. We report where your configuration differs, with remediation guidance.

Testing must comply with the relevant cloud provider's current policies and any restrictions that apply to the services in scope. The requirements can differ by provider and service. During scoping, we check the applicable rules and document any restrictions in the rules of engagement before testing begins.

We plan testing to minimise disruption, but some testing techniques carry operational risk. Before work begins, we agree testing windows, excluded systems and any restrictions on techniques. We also identify sensitive and business-critical services during scoping so that the approach can be adjusted accordingly. Where appropriate, testing can be scheduled outside peak hours.

External penetration testing assesses what an attacker can reach from the internet, including cloud-hosted assets. Cloud penetration testing adds a review of how your cloud accounts are configured against CIS benchmarks, and is scoped around your cloud environment.

Our CREST accreditation is for penetration testing. The CIS benchmark review is a configuration review, which is a separate service, and we don't claim CREST accreditation for it.

Retesting can be included in the engagement, depending on the agreed scope. Let us know when requesting a quote if you want remediated findings retested, and we'll confirm the arrangements in the proposal.

You can request a quote using the form on our quote page. Include your cloud providers, how many accounts, subscriptions or projects are in scope, the workloads you want tested and your preferred timing.

We reply within one business day to confirm your scope, then send a fixed-price written proposal.