A customer questionnaire, an auditor, or something you saw in the console. This is the review to do first.
A Sorami cloud security review examines four areas: identity and access, network exposure, logging and recovery. It covers AWS, Azure or Google Cloud on read-only access to your control plane. You receive a findings register where every line carries a severity, an effort estimate and a named owner. It is not a penetration test and attempts no exploitation.
A customer security questionnaire, an auditor, or a finding in the console that nobody can size.
A findings register. Every line carries a severity, an effort estimate and a named owner. Each one is marked fix now, fix at next change, or accept.
No. A review examines how the estate is configured. A penetration test validates what an attacker can reach. The review is usually first.
Read-only and scoped to the accounts in the review. Access is logged and revoked at handover. Findings stay in your systems.
One to three weeks depending on the number of accounts and how much is defined in code.
It produces evidence an auditor can read. Acceptance depends on their requirements, so send us their wording first.
A review reads the configuration. It does not attack anything, so if you need somebody to try, that is cloud penetration testing. We compare the trade-offs in cloud security review vs penetration test. Where a maturity level was named rather than a test, start with the Essential Eight assessment and the Essential Eight ML2 guide for AWS and Azure. If a customer asked for a report, SOC 2 readiness is the closer fit.
Send the accounts in scope and what prompted the question. We will confirm scope and fee first.
Last reviewed: