AWS security, proven by an attack
Short, fixed-scope engagements for startups and scale-ups on AWS. Each one starts and ends with a fire drill, so you see exactly what changed.
AWS Security Baseline in 2 weeks
You run on AWS, GuardDuty is (maybe) on, and nobody has checked what it would actually catch.
- Time
- 2 weeks
- Outcome
- A before-and-after report your team and your board can read.
What you get
- A fire drill against a sandbox copy of your setup: what is detected, only logged or missed
- GuardDuty, Security Hub and CloudTrail configured across the regions you use
- Alert routing to Slack, email or your pager, tested end to end
- Custom detections for the gaps GuardDuty leaves, as Terraform you own
- SCPs and RCPs for the risks that matter to you, proven to block
AWS controls that pass SOC 2
An audit is coming and you need the AWS controls to work, not just to exist on paper.
- Time
- 2–4 weeks, depending on scope
- Outcome
- Fewer surprises in the audit and evidence that is easy to repeat.
What you get
- Review of the AWS controls in your SOC 2 scope against what your auditor will test
- Fixes for the gaps: logging, detection, alerting, access guardrails
- Fire drill results you can hand over as evidence that the controls operate
- A short runbook so the evidence stays fresh after the audit
Monthly fire drill
Your setup changes every week and you want to know when a detection quietly stops working.
- Time
- Ongoing, cancel any month
- Outcome
- Detections that keep working, with a record that proves it.
What you get
- A monthly cloud-firedrill run against your sandbox or staging accounts
- New attack techniques added as they appear in the wild
- A one-page report with regressions and time-to-detect trends
- Fixes for anything that broke, included
From first call to hand-over
- 1
20-minute call
You describe your AWS setup and what worries you. We tell you honestly whether we can help.
- 2
Fixed proposal
Scope, timeline and price in writing within two business days.
- 3
Fire drill first
We measure before we change anything, so the result is a comparison, not a claim.
- 4
Hand-over
Everything is Terraform and documentation in your repository. No lock-in.
Common questions
Do you need access to our production account?
No. Attacks only ever run in a sandbox account you name. For configuration work we agree on scoped, temporary access and you can watch every change through pull requests.
Do we have to use cloud-firedrill?
No. It is how we measure, and it is open source, so you can keep running it after we leave. You don't pay for the tool.
Do we need a commercial SIEM?
No. Everything works with AWS-native services. If you already run a SIEM, we test and tune detections in it as well.
Which clouds do you cover?
AWS first. Kubernetes and EKS are next; ask if you run something else.