Cloud Penetration Testing

Blacklock begins by understanding the cloud account structure, subscription hierarchy, project organisation, services in use, business context and critical data flows.

Our consultants map VPCs, VNets, subnets, gateways, interconnections, exposed services, trust boundaries, workloads, resource inventory and security policies. This helps identify high-value assets, risky relationships and potential paths attackers could use to move through the cloud environment.

Blacklock performs automated cloud security checks across AWS, Azure and GCP services using a combination of licensed, open-sourceand custom tools.

For AWS, this may include tools such as Prowler, ScoutSuite, AWS Security Hub and custom audit scripts. Checks are aligned with CIS AWS Foundations, AWS Well-Architected Framework and AWS best practices.

For Azure, checks focus on identity, governance, networking, compute, storage, databases, key management, Defender posture,policy assignments and monitoring configuration.

For GCP, checks focus on organisation policy, IAMpermissions, service accounts, VPC firewall rules, public storage exposure, encryption, key management, logging, monitoring, Security Command Center findings and workload configuration.

Blacklock consultants manually review automatedfindings, validate misconfigurations and identify complex attack paths.

Testing includes IAM and privilege escalation review,overly permissive roles and policies, cross-account or cross-project accessrisks, public exposure of storage or resources, weak security groups, NSGs orfirewall rules, missing encryption, poor key management, secrets handlingweaknesses, insufficient logging and lateral movement scenarios.

Where safe and agreed, Blacklock simulates common cloudattack scenarios such as privilege escalation, resource exposure, misconfiguredtrust relationships and unauthorised access to sensitive cloud services.

Blacklock delivers clear, actionable reports forexecutive, technical and developer audiences. Reports include an executivesummary, vulnerability details, proof of concept, evidence, risk rating, impactand remediation recommendations.