Attack path diagrams
Step-by-step visual chains from external access to objective, with every hop documented.
Cloud
Cloud security.
The IAM misconfiguration your team hasn't noticed yet: the overpermissioned role that chains from a public endpoint to production data. We walk the chain end to end, and every hop lands as a policy diff you can apply.
// 01 — What it is
Identity is the perimeter. We test it end to end.
Cloud security failures are usually privilege chains rather than exploits. An overpermissioned role, a misconfigured trust policy, a public-facing Lambda with an exposed secret. We follow those chains to your data and document every link.
We cover AWS, Azure, and GCP: IAM graph analysis, cross-account privilege escalation, service misconfiguration, and data-plane access paths. Every finding comes with a policy diff you can apply.
- Full IAM privilege graph enumeration and attack-path modelling
- Cross-account and cross-service lateral movement chains
- External exposure: public APIs, storage buckets, snapshot sharing
- Policy diffs included with every IAM finding
- External entryExposed API key · public S3 · misconfigured ALBInitial access
- IAM enumerationOverpermissioned role → GetCallerIdentity → AssumeRoleDiscovery
- Privilege escalationiam:PassRole + lambda:InvokeFunction → admin policyEscalation
- Cross-account pivotAssume trusted role → secondary account accessLateral move
- Data accessS3 GetObject · RDS snapshot · Secrets Manager readObjective
- AWSAll regions
- AZUREMulti-tenant
- GCPAll services
// 02 — How we run it
Five phases from enumeration to hardening plan.
Environment review
We map your cloud footprint across accounts, regions and services in scope, then agree on the test boundary in writing.
Enumeration & mapping
External attack surface, IAM policy graph, service exposure, and cross-account trust relationships. All passive or credentialed, per scope.
Attack path analysis
We build the privilege chain from external access to your most sensitive data, hopping roles, services, and accounts along the way.
IAM & config review
Policy-level analysis: overpermissioned roles, wildcard actions, resource-based policies, and trust anchor misconfigurations.
Reporting & remediation
Attack path diagrams, IAM fix recommendations with policy diffs, risk-ranked misconfiguration inventory, and a prioritised hardening roadmap.
// 03 — What you get
What you close, and the order to close it in.
IAM policy review
Overpermissioned roles, wildcard actions, and trust misconfigurations with recommended policy diffs.
Misconfiguration inventory
Risk-ranked list of every exploitable misconfiguration in scope with CVSS scores.
Remediation roadmap
Prioritised fix plan with effort estimates. Ordered by blast radius and exploitability.
// next step
Every path to your data, walked and recorded.
Scoping call · attack path report · hardening roadmap.