# One wrong permission is enough. We find it first.

> A cloud penetration test assesses a cloud environment such as AWS, Azure, Microsoft 365 or Google Cloud for misconfigurations and attack paths: exposed services and storage, over-privileged identities, weak authentication and ways to escalate from one account to the whole tenant. Zyberum combines a configuration review with hands-on attacks and delivers prioritised findings with fixes.

Cloud pentests and configuration reviews for AWS, Azure, Microsoft 365 and Google Cloud: identities, permissions, exposed services and attack paths. Fixed price.

Source: https://zyberum.com/cloud-pentest

Most cloud incidents are not hacks of the provider. They are open storage, forgotten keys and roles that can do too much. We review your cloud the way an attacker would: from the outside, and from a compromised account.

## From the internet to tenant admin

### External exposure

Public storage, open management ports, forgotten test systems and leaked credentials.

### Identity & access

Roles and policies that allow privilege escalation, missing multi-factor, risky service accounts.

### Network & segmentation

What an attacker reaches after the first foothold, and what stops lateral movement.

### Workloads

Virtual machines, containers, Kubernetes and serverless functions, including their secrets.

### Logging & detection

Would you notice? We check whether our attacks show up in your logs and alerts.

### Microsoft 365 & Entra ID

Conditional access, guest users, app registrations, mail forwarding and sharing settings.

## Review plus attack

We start with a configuration review using read-only access, which covers the whole environment quickly. Then we attack: from the internet, and from the position of a normal user or a compromised workload.

The result is not a list of 400 settings. It is the handful of paths that lead from a small mistake to full control, in the order you should close them.

**What you get**

- Attack paths, shown step by step
- Findings prioritised by real risk
- Fixes as concrete settings or policies
- Evidence for NIS2 and ISO 27001 audits
- Retest after the fix

## FAQ

**Do we need permission from the cloud provider?**

AWS, Azure and Google Cloud allow penetration tests of your own resources without prior approval, within their published rules. We follow these rules and agree the scope with you in writing.

**What access do you need?**

Read-only access for the configuration review, and a normal user account for the attack part. We never need your administrator credentials.

**Is this the same as a cloud security audit?**

An audit compares settings against a benchmark. We do that too, but then we try to exploit what we find, so you know which issues matter.

---
Zyberum GmbH. Canonical page: https://zyberum.com/cloud-pentest