Bloomwiz Security · Cloud
Cloud Security
Most cloud breaches are not clever. They are a storage bucket left open, a role with more permission than it needs, or an environment nobody remembered was still running. We find those, score them, fix them, and keep them fixed.
- AWS, Azure and Google Cloud
- CIS Benchmarks and well architected guidance
- Scored on a five pillar maturity model
- Remediation by the same firm
The risk
What goes wrong in cloud
Cloud environments built at speed accumulate exposure quietly. Permissions granted for one task and never withdrawn. Development environments reachable from the internet. Logging switched off because it was noisy. Infrastructure deployed by a contractor who has since left.
None of it looks like a problem until it is one, and none of it shows up in an application penetration test.
Common findings
- Open storage
- Over permissive roles
- Internet reachable development environments
- Logging switched off
- Forgotten infrastructure
Assessment
Point in time assessment
| Service | What you get |
|---|---|
| Cloud security assessment | Posture review against CIS Benchmarks and the cloud provider’s own well architected security guidance. A snapshot of where you stand. |
| Configuration and network security review | Security groups, firewall and NSG rules, segmentation, routing, exposed management ports and public exposure. This is where we go deepest. |
| Cloud security maturity assessment | Scored maturity across five posture pillars, with gap analysis and a prioritised roadmap. A board ready number rather than an assertion. |
| Tooling advisory and implementation | Platform selection, deployment, integration and tuning. Vendor neutral. |
| Secure landing zone and architecture review | For environments being built or migrated. Account structure, segmentation, identity model and logging, settled at the start rather than corrected later. |
Ongoing
Continuous posture management
| Service | What it covers |
|---|---|
| Cloud security posture management | Multi cloud posture and misconfiguration across AWS, Azure and Google Cloud, with drift detection. |
| Kubernetes security posture management | Cluster and workload posture, image scanning, and checks gated in the deployment pipeline. |
| SaaS security posture management | Posture across the SaaS estate, including Microsoft 365 and the business applications you actually run on. |
| Identity and entitlement review | Who can do what and whether they should. Over permissive roles, unused credentials, standing privilege that should be temporary. |
| Managed posture service | Posture operated as a service, with the remediation handled by the same firm. |
| Benchmarking as a service | Periodic re scoring against CIS and cloud benchmarks, so progress is measurable between assessments. |
Model
The maturity model
Five pillars, each scored from 0 to 3. The score becomes the gap analysis and the gap analysis becomes the roadmap, which is why we lead with it rather than with a tool export.
| Pillar | Ad hoc (0) | Defined (1) | Optimised (2) | Expert (3) |
|---|---|---|---|---|
| Cloud posture | Manual checks | Basic scans, initial controls | Automated detection and dashboards | Enterprise wide, policy as code |
| Kubernetes posture | No cluster review | Ad hoc benchmark checks | Automated scanning | Continuous, gated in the pipeline |
| SaaS posture | Unmonitored | Key applications reviewed | Automated coverage | Continuous across the estate |
| Configuration and network hygiene | Undocumented rules | Periodic manual review | Automated baselines | Continuous drift detection |
| Tooling and automation | No tooling | Single tool, partial coverage | Integrated and tuned platform | AI assisted analysis and triage |
Independence
Vendor neutral by design
We hold partnerships with several cloud security posture providers and name none of them here on purpose. The right platform depends on the estate you have and what you already pay for, so we recommend on fit rather than on what we are obliged to sell. Where you already own a tool, we will operate that one.
Fixing it
Remediation
This is where being part of an engineering company matters. Bloomwiz already runs cloud migration, Kubernetes and infrastructure as code work. Findings can be fixed by the same firm that identified them, rather than handed to a team you still have to find.
Deliverables
What you receive
- A prioritised findings register, ranked by exploitability and blast radius rather than by tool severity.
- A remediation plan with an owner and an effort estimate against each item.
- A maturity score across the five pillars, so progress is measurable between assessments.
- Evidence suitable for customer security questionnaires and audit.
FAQ
Frequently asked questions
What is cloud security posture management?
Cloud security posture management continuously checks cloud accounts and services for misconfiguration, such as open storage or excessive permissions, and detects drift from the baseline you agreed.
Which clouds do you cover?
AWS, Azure and Google Cloud, plus Kubernetes clusters and SaaS estates including Microsoft 365.
Why does a cloud review find things an application pentest misses?
An application penetration test examines the application. Cloud exposure sits in configuration, identity and network rules around it, which need a different kind of review.
Do you recommend a specific tool?
No. We are vendor neutral and recommend on fit. Where you already own a tool, we will operate that one.
Talk to us
Not sure where to start?
A thirty minute conversation, no charge, and an honest view of what you actually need first. Most companies need less than they fear and something different from what they expected.