Fixed-scope engagement
Cloud Security Review
You want to know whether your company could actually be broken into — and get the holes closed, not just listed. This review finds the ways an attacker could really get in, fixes the most dangerous ones, and leaves your team a clear, ranked list for the rest.
Tell us what’s going onAt a glance
- Best for
- A trusted view of real cloud exposure
- Typical timeline
- A couple of weeks
- Most first reviews
- $8,500–$15,000 CAD
- Main result
- Top risks fixed; the rest ranked
The problem a cloud security assessment solves
Common situation: the scanner fires hundreds of alerts, compliance says everything is fine, and nobody can tell which issues create a real path to a breach. Root cause: severity-by-CVSS and posture scores don't model reachability, identity blast radius, or trust boundaries — so the real risk is buried in noise.
What you own when we leave
- A prioritized exposure register tied to concrete attack paths (entry → identity → blast radius), each item rated by the paths we assess as most reachable and their impact, not by scanner score.
- A threat model of your reviewed environment (trust boundaries, identity flows, the paths that actually matter).
- Terraform/IaC pull requests that remediate the top-ranked findings (tightened IAM, removed public exposure, segmentation, logging gaps closed) — merged or ready to merge in your repo.
- A short, ranked fix-it backlog for everything scoped but not implemented, written so your team or a follow-on engagement can execute it.
- ADRs for any structural decision we made.
Not a PDF of findings. Not a deck. The fixes are code in your repo — and if the board wants a PDF, we'll export one describing changes that already shipped.
How we approach it
- 01
Discovery
We read your accounts, configs, and constraints directly (scoped read-only access or exported state), map the real current state, and agree on a written scope and success criteria before any code is written.
- 02
Architecture Decision Records
We write down the key decisions — what we’re doing, the options we rejected, and why — as ADRs in your repo, so the reasoning survives long after we’re gone and you can challenge it before we build.
- 03
Implementation
We build the solution as reviewable Terraform/IaC in small, tested pull requests against your CI, so you watch it land incrementally and nothing arrives as a black box.
- 04
Handover
We walk your team through the repo, the threat model, and the runbooks live, confirm you can apply/destroy/extend it yourselves, and then we leave. You own everything — there is no phase 5 where you still need us.
Engagement shape
A bounded, fixed-scope review over a defined set of accounts/clouds, typically a couple of weeks of senior work, with a fixed deliverable list agreed up front. Most first reviews land between $8,500 and $15,000 CAD — smaller environments come in under that — and the exact fixed price is agreed in writing after scoping. This is the low-commitment way to work with us first: if it surfaces larger foundation, access, or networking work, the cost rolls into that engagement.
Fixed price, agreed in writing before we start. You can stop at the decision point and keep everything produced.
- 90-day warranty: anything we shipped that does not behave as documented, we fix at no charge.
- Discovery normally uses scoped, read-only roles you create and can revoke; data handling is agreed before access.
- If the review surfaces larger build work, the fee rolls into that engagement.
- A Senior Engineering Block is available afterward if the next backlog is better handled as flexible hours.
An illustrative example of the format
## EXP-001 — public jump host can assume the CI deploy role [rank 1]
Path: internet → EC2 (sg inbound 22 from 0.0.0.0/0) → instance profile
→ sts:AssumeRole ci-deploy → s3:* on the prod data buckets
Why rank 1: two hops from unauthenticated to prod data. The CSPM rated
the security-group finding "Medium" in isolation — reachability and the
role's blast radius are what make it critical.
Fix shipped: fixes/exp-001-jump-host.tf
- SSM Session Manager replaces inbound 22; the security group closes
- ci-deploy trust policy scoped to the runner role + ExternalId
- s3:* narrowed to the two buckets CI actually writes
Residual: none observed after apply — see threat-model/ci-deploy.mdFAQ
Questions about this engagement
What do I actually get — is this just a report?
No. Build engagements end with infrastructure-as-code in your repository: Terraform/IaC, the guardrail set (Service Control Policies or equivalents), a threat model, ADRs, and runbooks. The documents exist to help an engineer run the code — they are never a substitute for the working change. Code you own, not slides. The live software, illustrative technical formats, and public repositories on this site show how we document and build.
Why not just use a CSPM/governance SaaS or a Big-4 firm?
A SaaS dashboard observes and alerts; it rarely enforces inside your accounts, and the control leaves when the subscription does. A Big-4 engagement often ends in a framework and a recommendation to hire builders. We build the enforcing controls as code you keep. Different tools have their place — but if you want enforcement you own, that is specifically what we do.
What if something breaks after you’ve handed over and left?
Work we ship includes a 90-day warranty: if it does not behave as documented, we fix it at no charge — that is a defect, not new scope or time deducted from an Engineering Block. The code and documentation use standard tools your team or another engineer can maintain. If you want us back, the follow-on can be another defined project or a prepaid block of hours.
Can we keep you around after the engagement?
Yes. A Senior Engineering Block is a prepaid pool of hours for agreed investigations, reviews, changes, debugging, questions, or small pieces of implementation. It can follow a project or stand on its own. It is not a subscription, managed-service retainer, or emergency on-call service. Hands-on training is also available on your real environment rather than generic courseware. Neither is required; project handovers are designed so your team can run the result without us.
We already have a security team / platform team. Why bring you in?
Usually because they are at capacity, or the work needs a specific senior depth (landing-zone design, zero-trust enforcement, hybrid routing, AI guardrails) that is hard to staff for a one-time build. We work as reviewable PRs against your CI so your team reviews and absorbs everything as it lands — by handover it is genuinely theirs, not a black box dropped on them.
What access do you need, and how do you handle our data and credentials?
Discovery normally uses scoped, read-only IAM roles that you create and can revoke — not long-lived keys handed to us. Where possible, implementation runs inside your tenancy and CI. Any exports, working copies, retention, deletion, data location, and required service providers are scoped for the engagement and agreed before access is granted. You can inspect the public site too: cookie-free self-hosted analytics, a clean CSP, no session replay, and no advertising trackers.