CIS Foundations Benchmarks
The CIS Foundations benchmarks for AWS, Azure and GCP give us a concrete, per-control baseline to measure each account against.
Cloud security services
Cloud security services
Cloud security is the practice of finding and fixing the misconfigurations, over-broad permissions and exposed services across your cloud accounts before an attacker uses them, then keeping that posture from drifting.
CloudKey cloud security services assess your AWS, Azure and GCP environments against cloud security best practice, surface the misconfigurations that lead to breaches, and hand you a prioritized plan to harden posture and keep it hardened.
- AWS, Azure, GCP
- Cloud posture assessment
- IAM and exposure review
- Prioritized remediation
- Public storage bucket, world-readable Critical
- IAM role with wildcard admin policy Critical
- Security group open to 0.0.0.0/0 on port 22 High
- Root account without hardware MFA High
Illustrative dashboard, not a live system. Your assessment reports your own accounts against the CIS Foundations profile in scope.
Assessment scope
What a cloud assessment covers
Overview
Most cloud breaches start with a misconfiguration, not a zero-day
The cloud did not remove risk, it moved it. A public storage bucket, an over-permissive role, a forgotten internet-facing service: these are the everyday mistakes that turn into incidents, and they are easy to make and hard to spot from inside a busy account. CloudKey cloud security services find them.
We assess your cloud accounts against established best practice and the relevant CIS Benchmarks for AWS, Azure and GCP, review how identity and access are granted, and check what is exposed to the internet. Every finding comes with the evidence behind it, a risk rating, and a clear fix.
Cloud posture is not a one-time project, because cloud changes every day. We deliver a point-in-time assessment you can act on now, and we can advise on the posture management practices that keep new misconfigurations from creeping back in.
What we cover
What do CloudKey cloud security services cover?
The areas where cloud risk actually concentrates.
Cloud security posture assessment
Your AWS, Azure or GCP configuration measured against CIS Foundations benchmarks and cloud best practice, with every deviation documented and rated.
- Each account measured against its CIS Foundations baseline
- Every deviation documented with the evidence behind it
- Findings rated by risk, not dumped as a raw tool export
- Public storage bucket, world-readable Fail
- CloudTrail enabled in all regions Pass
- Default security group restricts traffic Partial
- Flow logs disabled on production VPC Fail
Illustrative. Settings are checked against the CIS Foundations profile in scope.
Identity and access (IAM)
Over-broad roles, unused privileges, missing MFA and risky trust relationships, the access paths that let one mistake become a full compromise.
- Over-broad roles and unused privileges right-sized
- MFA coverage checked across every account and root
- Risky trust relationships and cross-account access flagged
- Role with wildcard admin policy Critical
- Root account without hardware MFA Critical
- Access key unused for 90 days Medium
- Cross-account trust to unknown account High
Illustrative. Real reviews map each role and account to a named owner.
Exposure and network
Internet-facing services, open ports and public resources that should not be public, ranked by what is actually reachable.
- Internet-facing services and open ports inventoried
- Public resources that should be private surfaced
- Ranked by what is actually reachable, not theoretical
- Security group open to 0.0.0.0/0 on port 22 High
- Database snapshot shared publicly Critical
- Load balancer with no WAF in front Medium
- Static site bucket, intentionally public Reviewed
Illustrative. Exposure is confirmed against what is genuinely reachable.
Cloud security architecture review
A review of how your accounts, networks and guardrails are structured, with recommendations to reduce blast radius by design.
- Account and network structure reviewed end to end
- Guardrails and service control policies assessed
- Recommendations to reduce blast radius by design
How we work
Best practice, mapped to your cloud
We assess against published standards so the findings are objective and repeatable.
Provider Well-Architected guidance
Findings are framed against the security pillar of each provider's Well-Architected guidance, so recommendations fit how your platform actually works.
Ongoing posture management
Cloud drifts. We can advise on the cloud security posture management practices and checks that catch new misconfigurations as they appear.
How it works
How does a cloud security assessment work?
Read-only where possible, scoped to your accounts.
- 01
Scope and access
We agree which cloud accounts and services are in scope and set up read-only access, with the boundaries defined in writing.
- 02
Assessment
We evaluate configuration, identity and exposure against the relevant benchmarks and best practice, confirming findings rather than relying on a tool alone.
- 03
Prioritized findings
Each finding is documented with evidence, rated by risk, and given a concrete remediation step and owner.
- 04
Remediation support
We walk your team through the plan and the order to fix in, then re-check the high-risk items once they are addressed.
FAQ
Cloud security, answered
Cloud security services assess and harden your cloud environments. They find misconfigurations, over-broad access and exposed resources across providers like AWS, Azure and GCP, then give you a prioritized plan to fix them and keep your posture from drifting.
Cloud security posture management is the ongoing practice of continuously checking cloud configuration against best practice and flagging drift. A posture assessment is the point-in-time version; CSPM is the continuous one. We deliver the assessment and can advise on the continuous practice.
A cloud security assessment is a point-in-time review of your cloud accounts against benchmarks such as the CIS Foundations, covering configuration, identity and exposure. It produces documented, prioritized findings you can act on.
AWS, Azure and Google Cloud. We measure each against the relevant CIS Foundations benchmark and the security guidance for that platform.
No. An assessment reviews configuration and access against best practice. A penetration test actively attempts to exploit weaknesses to prove impact. They are complementary; many teams do both, and we offer cloud penetration testing as part of our penetration testing services.
Next step
See what is exposed in your cloud
Tell us which accounts and providers are in scope. We set up read-only access, assess against the right benchmarks, and come back with a prioritized plan and a fixed quote.