Configuration review
We analyse your cloud configuration and identity model without touching workloads.
- No production impact
- Fastest turnaround
- Great annual baseline
Most cloud breaches are not exotic exploits. They are a public bucket, an over-privileged role or a forgotten key. Protonyte audits AWS, Azure and GCP the way an attacker would, maps every finding to the relevant CIS benchmark, and helps you close the gaps - for teams in the United States, the UK, Canada and the Gulf.
We review your cloud configuration and identity model against attacker behaviour and CIS benchmarks, looking for the paths that turn one leaked credential into full account access.
The review combines read-only configuration analysis with hands-on testing of the paths we find, so you get proof of what is actually reachable rather than a raw list of misconfigurations.
Pick the depth that matches where you are in your cloud journey.
We analyse your cloud configuration and identity model without touching workloads.
We attempt real exploitation of the paths we find, from a low-privilege starting point.
Recurring reviews as your environment changes, with tracked remediation.
You grant a read-only audit role. We inventory accounts, regions, services and owners.
We map every role, policy and trust relationship to find privilege escalation paths.
We look at what is reachable from the internet and what an insider could reach.
We safely confirm the paths that matter, so you know which findings are theoretical and which are real.
You get a prioritised plan with exact fixes, mapped to CIS and your compliance needs.
Reports your board and your engineers can both use. No 400-page scanner dump.
Tell us about your systems and we will recommend the right assessment, with a clear scope and a fixed price.
Testing is remote work by nature. We scope on a call, test under a signed agreement and rules of engagement, and report inside your working hours - our day overlaps with the US morning. What changes from country to country is not the testing. It is the clause your report has to satisfy, and whether we are allowed to do the work at all, which we will tell you before you ask.
Where most of this work is bought, and where most of our enquiries now come from. Three things drive it. SOC 2 Type II: the criteria do not name a penetration test, but it sits in the points of focus under CC4.1 and auditors expect one inside the observation window. PCI DSS v4.0.1: 11.4.3 external and 11.4.2 internal testing at least annually, 11.4.6 every six months for service providers - and the tester does not have to be a QSA. The FTC Safeguards Rule: 16 CFR 314.4(d)(2)(i) requires annual penetration testing of any non-bank financial institution without continuous monitoring.
If you hold a NYDFS licence, 23 NYCRR 500.05(a) is explicit: penetration testing from inside and outside your system boundaries, by a qualified internal or external party, at least annually. The Second Amendment finished phasing in on 1 November 2025. California’s CCPA cybersecurity audit regulations took effect on 1 January 2026 and list penetration testing among the things the auditor assesses.
English-speaking, used to buying testing from outside their own borders, and driven by the same two things: ISO 27001 certification and the security questionnaire an enterprise customer sends before signing. We take private-sector work in all three. We do not take UK public sector or critical national infrastructure work, which is gated behind NCSC CHECK.
Where we started, and still a real part of the business. Abu Dhabi healthcare works to ADHICS V2 (yearly). Saudi entities under the NCA’s ECC 2:2024 test periodically, or six-monthly for critical systems. SAMA requires annual testing of customer and internet-facing services. UAE licensed financial institutions came under the Central Bank’s C 1/2026 on 14 September 2026. Our office and our academy are in Karachi.
We are a Pakistani company. Some US work is closed to a firm like ours, and you should hear that from us rather than from your own legal team three weeks in.
Everything else is paperwork, and we keep it ready rather than assembling it after you ask: a mutual NDA, a W-8BEN-E, the testers’ names and certification numbers, a redacted sample report, and a data-handling note saying what we hold and when it is destroyed.
Not sure which of these applies to you? The compliance and audit page sets out what each framework actually asks for, side by side.
No. A read-only audit role is enough for the configuration review. Hands-on testing uses a low-privilege account you create for us, with scope agreed in writing first.
Yes. We regularly review AWS Organizations, Azure tenants with multiple subscriptions, and mixed environments. Scope and pricing scale with the number of accounts.
Yes. Findings are mapped to CIS benchmarks and the relevant controls, and the report is written so auditors accept it as evidence of testing.
Cloud changes faster than on-premise, so quarterly is ideal for active environments, and at minimum annually or after any major architectural change.
Each provider publishes its own policy on customer penetration testing, and the details change. We confirm the current rules for your provider and services during scoping, and we do not test anything you cannot authorize in writing.
A configuration review reads your account the way an auditor would: identity policies, storage permissions, logging, network rules, measured against CIS benchmarks. A cloud penetration test attacks it the way an intruder would, starting from whatever foothold is realistic, and proves what that foothold actually reaches.
Identity, almost always. Over-privileged roles, long-lived access keys and trust relationships that let one compromised function assume another role are what turns a small mistake into a full account compromise - far more often than an exotic exploit.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.