Read-only review of your cloud and SaaS environments against CIS benchmarks and CISA SCuBA baselines, with the attack paths that connect them and a 30/60/90 roadmap.
Attackers don't stop at the edge of one console. We review the platforms you run together, in one engagement.
AWS, Azure, GCP
Google Workspace, Microsoft 365 / Entra ID
The CIS Foundations Benchmark for each platform in scope.
CISA's Secure Cloud Business Applications baselines for Google Workspace and Microsoft 365.
The assessment runs on read-only access to your configuration. We don't change settings, and we agree on the exact access method during scoping. A benchmark result is only the start, so a senior operator reviews each gap in context and tells you which ones matter.
We'll sign your NDA and MSA before any work begins.
Each platform against its CIS benchmark and SCuBA baselines.
The gaps that chain together across platforms.
Prioritized fixes, sequenced into 30, 60, and 90 days.
Both tiers apply to any platform above.
Where your settings stand against the baselines.
Everything in the Configuration Assessment, plus how an attacker would move through your environment.
Add it to either tier.
We prove the risky paths by attempting them: OAuth consent abuse, delegation and role abuse, external sharing, and email spoofing. Agreed in writing before it starts.
An executive summary your leadership can read, plus each finding with the current setting, the risk, the benchmark reference, and the fix.
Fixes sequenced by risk and effort, so your team knows what to do first and what can wait.
A working list of every finding your team can assign, update, and close.
A live walkthrough with your team to go over what we found, why it matters, and what to do next.
Included in both tiers. Fix what we found, and we retest it. Retests are included within 90 days of report delivery, and the report is updated to show which findings are closed.
Send what you have. Rough answers are fine for a first pass, and we'll come back with a scope, a timeline, and a fixed price.
Tell us your platforms and your date. We'll come back with a scope, a timeline, and a fixed price.