An independent, read-only scan of your AWS account across every enabled region. Risk-rated findings and clear remediation steps, with your report within 48 hours.
Illustrative scan of a sample account.
Every enabled region, across services including
We scan every enabled region of your account for the misconfigurations most likely to lead to an incident, then tell you how to fix what we find.
Root account usage and MFA, over-permissive roles, long-lived or unused keys, and risky cross-account trust.
CIS 1.4Public buckets and snapshots, encryption at rest, backups, KMS key rotation and open queues or topics.
CIS 2.3Admin ports and databases open to the internet, permissive security groups and missing flow logs.
CIS 5.2Instance metadata settings, outdated Lambda runtimes, unauthenticated function URLs and exposed EKS endpoints.
CIS 5.6CloudTrail coverage, GuardDuty, Security Hub, AWS Config and Access Analyzer. Would you notice if something went wrong?
CIS 3.1The account-level basics, like a registered security contact so AWS can reach you about an incident.
CIS 1.2Findings mapped to the controls auditors and customers ask about. Mappings are indicative, not an attestation.
We connect through a role you create and control. Nothing is installed, nothing is changed, and you remove it when we're done.
Plain-English findings rated by risk, with CLI and Terraform fixes for every affected resource.
Create a read-only role in your account from our template. It takes a few minutes.
We scan every enabled region and review the results. Your report lands within 48 hours.
A walkthrough of your findings and a fixed-price quote to close them.
Guided or done for you, then a re-scan to prove the gaps are closed.
Know where you stand, fix what matters, then stay secure as you grow.
Find out where you stand. Fully credited if you go ahead with remediation.
Close the gaps, your way.
Stay fixed as you grow.
Every engagement is quoted up front. Multiple accounts or an AWS Organization? We'll scope it with you.
A read-only role that you create in your account from a template we provide. It can't change anything, and you remove it when we're done. We'll walk you through it on a short call before the scan.
No. The scan only reads configuration through the AWS APIs. Nothing is installed and nothing is modified.
No. It's a configuration and posture audit: it finds the misconfigurations attackers exploit, without actively attacking your systems. If you also need a pentest, we'll help you scope one.
No. SOC 2 reports are issued by licensed CPA firms. Your scan maps findings to the SOC 2 criteria (indicatively), and remediation closes the gaps, so you walk into that audit prepared.
Your scan report lands within 48 hours of the role being connected. Remediation depends on what we find; your quote includes a phased plan and timeline.
Yes. If you go ahead with remediation, the full scan fee comes off the remediation price.
Findings are confidential, shared only with your nominated contacts and deleted on request. Happy to sign your NDA before we start.
Tell us a little about your AWS setup and we'll get your scan booked.
We've sent a confirmation to your inbox. Andrew will be in touch within one business day.