AWS Security Audit
Full review against the CIS AWS Foundations Benchmark and the Well-Architected Security Pillar: IAM, logging and detection, data protection, network exposure and incident readiness.
AWS · DevSecOps · Offensive Security
Find the gaps before attackers do.
Security assessments by engineers holding 5 AWS certifications, including Security – Specialty. We review your cloud, pipelines and network, test them the way an attacker would, and hand you a prioritised plan to fix what matters.
- Security Specialty · since 2018 ✓
- Solutions Architect Professional
- DevOps Engineer Professional
- Solutions Architect Associate
- SysOps Administrator Associate
What we do
Landing Zone Review
AWS Organizations, Control Tower or custom landing zones: SCPs, guardrails, account structure, centralised logging, Security Hub and GuardDuty coverage, break-glass access.
EKS & Kubernetes Security
Cluster configuration, IRSA and Pod Identity, RBAC, network policies, admission control, image provenance, secrets handling and runtime detection, benchmarked against CIS EKS.
CI/CD & DevSecOps Posture
GitHub Actions, GitLab CI, Jenkins or CodePipeline: secret leakage, over-privileged runners, OIDC trust misconfiguration, supply-chain risk and missing SAST/SCA/IaC gates.
Vulnerability Analysis
Authenticated scanning of hosts, containers and infrastructure-as-code (Terraform, CloudFormation, Helm), with manual triage so you see real, exploitable issues instead of scanner noise.
Simulated Offensive Testing
Controlled attack simulation across cloud, pipelines and internal network: privilege escalation, lateral movement, credential exposure and blast-radius analysis. Always under signed authorisation.
How an engagement works
Scope
Free 30-minute call to agree targets, goals, timeline and rules of engagement.
Authorise
NDA, statement of work and written testing authorisation signed by the asset owner.
Assess
Read-only cloud review first, then active testing in agreed windows. Critical findings reported within 24 hours.
Report & retest
Executive summary, technical report with fixes, walkthrough call and a free retest of critical and high findings.
What you receive
Reports written for both leadership and the engineers who will fix things.
- Executive summary for leadership and auditors
- Risk-ranked findings with evidence and reproduction steps
- Copy-paste fixes: IAM policies, Terraform, Kubernetes manifests
- Mapping to CIS, Well-Architected, SOC 2 and ISO 27001 controls
- Walkthrough call with your team
- Retest of critical and high findings
Leadership
Peter Velas
Principal Security Consultant
Peter has worked in infrastructure since 2007 and on AWS since 2012. He started as a systems administrator, then worked as an AWS SysOps engineer, cloud engineer and cloud architect. For the last five years he has focused on DevSecOps: securing AWS landing zones, EKS platforms and CI/CD pipelines in production. He holds 5 AWS certifications, including AWS Certified Security – Specialty, which he has held since the exam's beta (issued October 2018).
- 2007 Systems administrator
- 2012 AWS SysOps engineer
- 2014 Cloud engineer
- 2018 Cloud architect
- 2021 DevSecOps & cloud security
Verify AWS Security – Specialty on Credly → LinkedIn profile →
Frequently asked questions
Do you need admin access to our AWS account?
No. Cloud reviews use a read-only IAM role (SecurityAudit and ViewOnlyAccess) that you create and can revoke at any time.
Will testing disrupt production?
Active testing runs only in agreed windows and within the rules of engagement. Denial-of-service and destructive tests are excluded unless you request them in writing.
Do you follow AWS's penetration testing policy?
Yes. AWS permits customers to test listed services without prior approval. We stay within that policy and the scope you authorise.
How long does an engagement take?
A focused single-account review takes about a week. A full assessment takes 2–3 weeks. Offensive engagements depend on scope.
How do you handle our data?
Under NDA, with encrypted storage, and collected data is deleted when the engagement closes.
Can you help us fix the findings?
Yes. Remediation support is available as a follow-up engagement.
Let's talk
Tell us what you want assessed: AWS accounts, EKS clusters, pipelines or internal network. We reply within one business day.
