We audit identities, network, data and deployment pipeline across your AWS accounts. We prioritise by real risk, fix in code and leave detection running so you see the next finding before anyone else does.
An excerpt from our checklist. Every finding is scored by likelihood of exploitation and impact on your business, not just by the tool's generic severity.
| Typical finding | Risk | How we close it | Control |
|---|---|---|---|
| Long-lived IAM access keys on human users | Critical | Migration to IAM Identity Center with SSO and temporary roles; key rotation and removal | CIS 1.4 · ENS op.acc |
Policies with * in action and resource | Critical | Least privilege derived from IAM Access Analyzer and real activity over the last 90 days | CIS 1.16 |
| Publicly accessible S3 buckets or RDS snapshots | Critical | Account-level Block Public Access, reviewed bucket policies and alerts on changes | CIS 2.1 |
| CloudTrail without multi-region coverage or integrity | High | Organisation trail, integrity validation and retention in an isolated log account | CIS 3.1 · ENS op.exp |
| Security groups open to 0.0.0.0/0 on SSH or RDP | High | Access via Systems Manager Session Manager; removal of exposed admin ports | CIS 5.2 |
| Secrets in environment variables or in the repository | High | Secrets Manager with rotation, secret scanning in CI and revocation of exposed ones | — |
| Container images neither scanned nor signed | Medium | Inspector on ECR, signing with Signer and admission policy on EKS | SLSA |
| No response plan or restore tests | Medium | Runbooks, incident drill and quarterly backup restore test | ENS op.cont |
Ten days with read-only access. Risk-prioritised report, with evidence per finding and a remediation plan estimated in effort.
We close findings in Terraform or CDK, with your team's review and environment-by-environment deployment. Nothing is changed by hand in the console.
GuardDuty, Security Hub, Inspector and Config with rules tuned to your environment to cut noise, and automated responses for the repetitive.
We map your technical controls to ENS or PCI DSS and generate automated evidence so the audit does not stall your team.
We define the accounts and systems in scope. We request a read-only role with the published policy; never administrator credentials.
Automated tools plus manual review of IAM, network and architecture. Every finding carries reproducible evidence.
Separate presentations for management and engineers: business risk for one, concrete steps for the other.
We close the critical and the least effortful items first. We verify with a second pass at the end.
A role with the SecurityAudit and ViewOnlyAccess managed policies, assumable from our account with an ExternalId. We publish the exact policy and you remove it when we are done.
No. The audit is read-only. Active penetration tests are agreed separately, with a signed window and scope.
We review the deployment pipeline, dependencies and configuration. In-depth application code review is coordinated with a specialised partner when needed.
The full report with evidence, the prioritisation and the estimated remediation plan. It is yours and your team can execute it on its own.
A ten-day audit gives you the answer with evidence.
Tell us how many accounts you have, which regulations apply and whether an external audit is on the horizon. We reply within 48 hours.
What we have written about this, from projects we have run.
The choice is not about features. It is about whether you are multi-cloud, whether you need short-lived database credentials, and how much operational load your team can carry.
California set the template and a growing list of states copied it with variations. What differs from GDPR, why the browser opt-out signal is the part teams miss, and how to build once for a list that keeps growing.
Most inventory tools ask for read-only access and trust you got it right. We made Skyline prove it first, because the ReadOnlyAccess policy a team hands you is very often not what they think it is.