What we test
A cloud estate is not a network with a different logo. The attack surface is identity, trust relationships, and the APIs that glue them together — a role that can assume another role, a storage account that is public because a flag was left on, a CI identity that can reach production because nobody scoped it.
We test that surface the way an attacker would: start from what is exposed or what a typical identity can do, then follow it until we hit a control that actually stops us, or until we reach something you would not want us to reach.
This is a different engagement from network penetration testing. Network work answers how far someone gets on the wire. Cloud work answers how far a principal gets once it can call your APIs.
AWS, Azure, and GCP
The methods differ by provider. The question does not.
Identity. Users, roles, service principals, managed identities, and the trust between them. Over-permissioned roles and forgotten federation are the usual path to a tenant-wide problem.
Storage and data. Buckets, blobs, and databases that are reachable because of a policy, a snapshot, or a replica nobody remembered.
Compute and runtime. Instances, functions, containers, and the metadata services they expose to anything that lands on them.
Control plane. The APIs and consoles an attacker uses once they have a foothold — often more valuable than the workload they landed on.
Where configuration review stops
A configuration review reads the tenant and tells you what is wrong. This engagement tries to use it. If you already know the settings are messy and want proof of impact, start here. If you want a read-only pass first, start there.
What you receive
A report ranked by what an attacker actually reached, with the principal, the path, and the change that closes it. We retest once you have remediated, the same as any other penetration test.