For
Teams running or moving workloads on AWS, Azure or Google Cloud.
- AWS
- Microsoft Azure
- Google Cloud
Cloud security services in the UAE: Cloud you can trust, on AWS, Azure and Google Cloud.
The provider secures the platform. You secure what you put on it. We find the gaps in your side of that line, fix the ones that matter and set guardrails so they stay fixed.
You get
A baseline of your current posture, a fix list ranked by exposure, and guardrails that prevent repeats.
- Baseline of your posture
- Fix list ranked by exposure
- Guardrails that prevent repeats
How it runs
Read-only access first. Changes happen only with your approval.
Not included
Running your cloud platform day to day, or 24/7 monitoring. See SOC / MDR.
The route an attacker would take, and where we check
We review each layer in the order attackers tend to use them.
Choose an attack and press Run attack.
Identity and access
Who and what can sign in and change things.
- Strong sign-in for every human
- No long-lived keys in code
- Least-privilege roles
- Review of service and machine accounts
Network and exposure
What is reachable from the internet, and from other networks.
- Public storage and databases found and closed
- Segmentation between environments
- Controlled outbound traffic
Workloads
Servers, containers and serverless functions.
- Hardened images
- Patch and vulnerability routine
- Container and Kubernetes settings reviewed
Data and keys
Where data sits and who holds the keys.
- Encryption in place and verified
- Key ownership and rotation
- Data location checked against your rules
Logging and response
What you can see and what you can prove.
- Audit logs on, kept and protected
- Alerts for risky changes
- A tested path from alert to action
An illustration of how a check works. Not a recorded incident.
The same job, in each provider's own terms
Pick a provider. The jobs stay the same. The names change.
AWS
IAM
CloudTrail
Security Hub
KMS
Security groups
Microsoft Azure
Microsoft Entra ID
Activity Log
Defender for Cloud
Key Vault
Network security groups
Google Cloud
Cloud IAM
Cloud Audit Logs
Security Command Center
Cloud KMS
VPC firewall rules
One-off review or continuous guardrails
Same fixes on day one. What happens next is different. Pick one.
Posture review
- What it does
- Finds what is wrong today and ranks the fixes.
- Strength
- Fast. Good before an audit or a migration.
- Best for
- A first look, or a snapshot for an auditor.
Guardrails in the platform
- What it does
- Blocks the risky setting before it ships, using policy in the platform.
- Strength
- Lasting. Fixes stay fixed as teams change things.
- Best for
- Teams deploying often with infrastructure as code.
What you hold at the end
Pick a document to see what it looks like.
By account and by risk
Identity and access
Network and exposure
Workloads
Data and keys
Logging and response
Illustrative layout
ItemReasonOwnerEffort
1
2
3
4
Illustrative layout
Power held against power needed
Roles
Keys
Machine accounts
Needed Held
Illustrative layout
Policy, then your build pipeline
Block public storage
Require short-lived credentials
Keep audit logs on
PolicyBuild pipelineBlocked or shipped
Illustrative layout
SourceCollectKeep
Sign-ins
Configuration changes
Network flows
Data access
Illustrative layout
Sample finding (illustrative)
Finding
A storage bucket holding exports is readable from the internet.
Risk
customer data is retrievable by anyone with the link.
Fix
close public access and block it by policy.
Finding
A long-lived access key sits in a code repository.
Risk
anyone with repo access can act as that service.
Fix
rotate, then move to short-lived credentials.
Benchmarks we check against
-
CIS Foundations Benchmarks
Consensus settings for AWS, Azure and Google Cloud accounts.
Read the source -
CSA Cloud Controls Matrix
A control framework built for cloud services and their customers.
Read the source -
ISO/IEC 27017
Cloud-specific guidance that extends ISO/IEC 27002.
Read the source
Where data lives matters
Pick a topic. The part of the picture that matters lights up.
Residency
AWS and Azure both operate cloud regions in the UAE. We check that your data sits where your rules and contracts say it should.
Transfers
Moving personal data out of the UAE has conditions under the UAE PDPL. Your counsel confirms what applies.
Provider duties
Providers publish a shared responsibility model. We map it to your account so each duty has a named owner.
See your cloud the way an attacker would.
Tell us which provider and how many accounts. We scope a review.
