Use of cloud services
Acquire, use, manage and exit cloud services in line with your security requirements.
Cloud Security & Assurance
Know what your cloud actually exposes.
Cloud security engineering for AWS, Azure and Google Cloud. We test your estate the way an attacker and an auditor would, then build the guardrails, landing zones and fixes with your engineers, this sprint.
- AWS
- Microsoft Azure
- Google Cloud
- Who it is for
- Cloud-first SaaS and regulated institutions
- Coverage
- AWS, Azure, Google Cloud, Kubernetes and IaC
- Access model
- Read-only, time-bound roles you create and revoke
- You receive
- Ranked findings, attack paths, remediation code and guardrails engineered with your team
The challenge
The provider secures the cloud. Everything you build in it is yours.
The decisions behind most cloud incidents sit on your side of the line: identity, exposure, logging and keys.
Posture tools raise thousands of alerts. They can’t tell you which three would let an attacker reach your payment data. We can.
A dashboard tells you what is misconfigured. An assessment tells you what an attacker could do with it.
Outcomes
What changes after an assessment
01
An inventory you can defend
Every account, cluster and data store mapped to an owner.
02
Least privilege, proven
Effective permissions analyzed across roles and federation.
03
Exposure ranked by attack path
Ordered by what can be reached and chained, not by scanner output.
04
Fixes in your engineers’ language
Terraform diffs, policies and guardrails that stop regressions.
Shared responsibility
Identity and data are always yours
The boundary moves with each service model. Assessors in every framework test the customer side of the line.
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Facilities, hardware, hypervisor | Provider | Provider | Provider |
| OS and runtime patching | You | Provider | Provider |
| Network controls | You | Shared | Provider |
| Service configuration | You | You | Shared |
| Identity and access | You | You | You |
| Data protection | You | You | You |
Simplified. Each provider’s documentation defines the exact split.
Boundary protection
Logical access measures against threats from outside the system boundary.
CDE network controls & logs
Restricted traffic to cardholder data; logs retained for at least 12 months.
Least privilege
Only the access each user and process needs, with no standing admin credentials.
Interactive demonstration
A multi-cloud assessment, in miniature.
A fictional payments company across three clouds. Filter findings, open the evidence and follow the attack paths that chain them together.
A simulation with synthetic data. Nothing connects to a real cloud account.
Loading interactive demonstration…
Every asset, finding and score in this panel is synthetic and generated in your browser. Nothing is scanned, collected or sent.
Methodology
How we assess a cloud estate
- Phase 01
Discover
Landing zone, federation and the workloads that matter.
- Phase 02
Assess
Read-only analysis, architecture review and a permission graph.
- Phase 03
Remediate
Fixes sequenced by attack path, delivered as code.
- Phase 04
Validate
Retesting and an evidence pack for your frameworks.
- Phase 05
Sustain
Managed drift detection, guardrail tuning and ongoing cloud security engineering.
Posture tooling
“Bucket is public.”
MarkTillson assessment
What the bucket holds, who relies on it, and the attack path it opens.
Capabilities & deliverables
What the service includes
Posture assessment
Every account and project, with each finding validated by a consultant.
Landing-zone review
Account structure, segmentation and guardrail inheritance.
Entitlement review
Human and workload identities, analyzed as effective permissions.
Kubernetes security
EKS, AKS and GKE: RBAC, workload identity and admission control.
Infrastructure-as-code review
Terraform, CloudFormation and Bicep, reviewed before deployment.
Cloud penetration testing
Run within each provider’s published testing policy.
Penetration testingAccreditation & scope
One assessment, carried into every audit
What MarkTillson delivers
- Cloud security engineering: landing zones, guardrails and policy as code
- Independent configuration and architecture assessment
- Identity, Kubernetes and IaC review
- Cloud penetration testing
- Evidence packaged for audits and customer reviews
Where the evidence goes next
- PCI DSS readiness and FedRAMP readiness, built on the same engineered controls
- ISO/IEC 27001 certification audits and SOC 2 examinations, ready on day one
Framework mapping
One assessment, several audiences
| Control area | CIS | ISO/IEC 27001 | SOC 2 | PCI DSS v4.0.1 | NIST 800-53 |
|---|---|---|---|---|---|
| Identity & least privilege | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Network exposure & segmentation | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Data protection & encryption | Partially addressed | Directly addressed | Partially addressed | Directly addressed | Directly addressed |
| Logging & retention | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Cloud provider oversight | Not addressed– | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. Mappings guide planning. Each framework’s own text is authoritative.
Industry considerations
Same providers, different obligations
Under DORA, cloud supporting critical functions needs a register entry, contractual terms and a tested exit strategy.
DORA readinessA cloud-hosted CDE is still your PCI DSS scope. The provider’s AOC covers only its side of the line.
PCI DSS assessmentEnterprise buyers want proof of tenant isolation and governed production access.
SOC 2 readinessPHI turns up in logs, exports and feature stores that nobody designed to hold it.
HITRUST readinessAuthorization boundaries and NIST SP 800-53 baselines, increasingly validated by automation.
FedRAMP assessmentRisks we test
The cloud risks we find most
Long-lived keys in pipelines
Static keys in CI variables, images and repos.
Over-trusting cross-account roles
A compromise elsewhere becomes a compromise here.
Metadata credential theft
SSRF combined with permissive instance metadata.
Public snapshots & links
Production data copied outside the perimeter.
Cluster-admin by default
One container becomes a cluster-wide incident.
Model endpoints & vector stores
Deployed fast, outside landing-zone guardrails.
Engagement journey
From scoping call to closed findings
-
01
Scoping
Accounts, frameworks and rules of engagement.
OutputScope and access plan
-
02
Access
You deploy read-only roles from our templates.
OutputVerified access
-
03
Assessment
Collection, validation and identity-path analysis.
OutputDraft findings
-
04
Workshop
Attack paths walked through and owners assigned.
OutputRemediation pack
-
05
Retest
Fixes verified and evidence packaged.
OutputValidation report
FAQs
Questions teams ask
What access do you need?
Read-only roles that you create, scope and revoke, such as AWS SecurityAudit, Azure Reader and Security Reader, or Google Cloud Viewer. We supply the templates.
Will you change anything in our environment?
No. Configuration assessment is read-only. Active testing is agreed separately, under explicit rules of engagement.
We already have a CSPM tool. Why this?
Tools detect. An assessment adds validation, business context, identity paths and a plan your engineers can work through in order.
Do providers need to approve testing?
Not for configuration review. For penetration testing we follow each provider’s published policy and confirm it at scoping.
Can one assessment support several frameworks?
Yes. We organize the evidence for reuse and flag anything extra a particular framework needs.
Related
Where cloud assurance connects
Speak with an expert
Find out what your cloud really exposes.
Tell us your providers and the frameworks you answer to. A cloud specialist will come back with a proposed scope within one business day.