Cloud security
Posture, identity, network and Kubernetes security on AWS, Azure and Google Cloud.
Most cloud breaches start with a misconfiguration, not an exotic exploit: an over-permissive role, a public bucket, a forgotten key. We review your cloud the way an attacker would, then fix it as code — least-privilege identities, segmented networks, secrets in a vault, hardened containers — so the secure state is versioned and stays that way as your team ships.
01 / What it solves
Identities, exposure, storage, encryption and logging checked against provider baselines and CIS benchmarks, with a prioritised fix list.
Roles scoped to what each person, service and AI agent actually needs — no long-lived keys, no shared admin accounts.
Private endpoints, tight security groups and controlled egress, so one compromised service cannot reach everything else.
Minimal images, admission policies, network policies and runtime limits for EKS, AKS, GKE or self-managed clusters.
02 / Stack
Industry-standard, boring in the good way: tools with a future, that the next engineer will know too.
Clouds
AWS
IAM, Organizations, GuardDuty, Security Hub
Microsoft Azure
Entra ID, Defender for Cloud, Policy
Google Cloud
IAM, Security Command Center, VPC Service Controls
Posture & scanning
Prowler
Open-source posture checks against CIS and provider baselines
Checkov / tfsec
Policy checks on infrastructure as code before it ships
Trivy
Image, dependency and misconfiguration scanning
Kubernetes
Kyverno / OPA Gatekeeper
Admission policies as code
Cilium
Network policies and service-to-service encryption
Falco
Runtime detection of suspicious behaviour
Secrets & keys
HashiCorp Vault / OpenBao
Central secrets with short-lived credentials
Cloud KMS
Customer-managed keys and rotation
External Secrets Operator
Secrets synced into Kubernetes without plaintext in Git
03 / Approach
Every fix lands in Terraform, OpenTofu or Pulumi with review, so it cannot quietly drift back.
Internet-facing exposure and over-privileged identities before cosmetic findings.
Policies in CI and at the organisation level that block risky changes but let your team keep shipping.
Each control is written down with its reason, so your team and your auditor can follow it.
04 / Standards
We adhere to industry standards and proven methods on every project — they are what makes the estimate hold.
05 / Infrastructure
Good questions
Straight answers to what buyers ask before they start.
AWS, Microsoft Azure and Google Cloud, including multi-cloud setups and Kubernetes clusters on any of them (EKS, AKS, GKE) or self-managed.
Related work
Projects and products of ours that involved this service.
Start
Tell us which clouds and accounts you run. A senior engineer writes back with an honest scope and price for a review.
Let’s manage See zero-trust architecture
