What we look at
The audit covers five areas. Each is scored red, amber or green against a short list of yes/no checks, so the result is the same whoever runs it. The full rubric is public.
- Security posture. Account structure, SSO, long-lived keys, public buckets, audit logging, secrets, and whether your production database is reachable from the internet.
- Cost and waste. Who owns the bill, unexplained line items, NAT and data-transfer charges, commitment coverage, tagging, and non-production environments running 24/7.
- Infrastructure as code. How much of production lives in Terraform, Pulumi or CloudFormation, how state is stored and locked, and whether you could rebuild an environment from code.
- Observability and on-call. Central logs, golden-signal metrics, alerts that fire on user-visible problems, paging and runbooks.
- Resilience and recovery. Backups that have actually been restored, multi-AZ where it matters, and a recovery plan someone has rehearsed.
How the week runs
- Day 1: access and listening. You grant read-only access. We walk through the console, repositories, on-call rotation and last quarter's incidents with your team.
- Days 2 to 4: review. We go through each area, check the findings against the rubric and note evidence for every red and amber.
- Day 5: the report. One page of findings with a short appendix of evidence, walked through with you on a call. You also get a prioritised list of what we would do first, second and third.
The report is yours to keep. Re-run the same rubric in six months and you will see the greens add up.
Who it is for
- Teams that inherited a cloud setup and don't fully trust it.
- Founders preparing for a funding round, a large customer's security review, or an acquisition.
- CTOs who want an outside opinion before a big decision such as a migration, a move to Kubernetes, or a new hire.
What happens after
Nothing, if you like: many teams fix the findings themselves. If you want help, the audit becomes the scope for a build or migration project, a run and support retainer, or fractional CTO support.
Frequently asked questions
What access do you need?
Read-only access to your cloud accounts (for AWS, a role with the ReadOnlyAccess and SecurityAudit policies), read access to your repositories and CI, and an hour or two with the people who run production.
Which clouds do you audit?
AWS, Google Cloud and Azure, including Kubernetes on EKS, GKE and AKS. Most of our audits are on AWS.
How much does the audit cost?
The audit is fixed in scope, so you get a fixed price before we start. It depends mainly on how many accounts and environments you run. Email [email protected] for a quote.
Will you change anything during the audit?
No. The audit is read-only. If we find something urgent, such as exposed credentials, we tell you the same day so you can act on it.
How is this different from AWS Trusted Advisor or a security scanner?
Tools list symptoms. We look at how your team actually works: who owns the bill, whether anyone is paged at night, whether you could rebuild production. The output is a prioritised plan, not a list of 400 warnings.