Cloud Security Audit & VAPT in India — AWS, Azure, GCP.
From IAM privilege escalation to S3 misconfigurations, exposed Lambda functions to over-permissive K8s RBAC — Macksofy assesses your cloud environment with the same depth as on-prem, but with cloud-native tooling and attacker tradecraft.
What is a cloud security assessment?
A cloud security assessment reviews your AWS, Azure, or GCP environment for misconfigurations, over-permissive IAM, exposed storage, and weak network controls, benchmarked against CIS and provider best practice. Macksofy combines CSPM tooling with manual review and maps findings to RBI, SEBI, and DPDP data-residency requirements.
IaaS. PaaS. SaaS. All three break differently.
A cloud assessment that only checks one layer misses two thirds of the attack surface. We test the way attackers move — across the stack, not inside a single tier.
EC2, Compute Engine, Azure VMs — your direct responsibility from the OS up.
- VPC / VNet segmentation + flow-log audit
- Instance metadata service (IMDSv1 / SSRF) abuse
- Custom AMIs, snapshots, exposed disks
- Provider-IAM role mis-scoping
Lambda, App Service, Cloud Functions, RDS, EKS control planes — where the wiring usually breaks.
- Function execution-role privilege escalation
- Managed-DB public exposure + auth-replay
- Service-mesh + API-gateway auth bypass
- Secrets in environment variables and build logs
M365, Google Workspace, Salesforce, Atlassian — your data, someone else’s ops.
- Tenant-isolation + cross-tenant data exposure
- OAuth scope sprawl + consent-grant abuse
- SCIM provisioning drift + dormant identities
- Conditional-access / DLP bypass
3 clouds. 12 services. 13 findings.
Composite from a 2025 assessment of a Series-B SaaS running multi-cloud across AWS, Azure and GCP. Each tile maps to CIS benchmarks + provider best practice.
One overscoped role = five privesc paths.
Cloud breaches almost never need a CVE. The Lambda execution role withs3:* +iam:PassRole *is what turns a single SSRF into AWS account takeover.
- Prevent the next 'misconfigured S3' headline
- CIS benchmark + cloud-provider best-practice attestation
- Reduce cloud bill by exposing rogue + over-provisioned resources
- Satisfy SOC 2 / ISO 27001 / CERT-In cloud audit requirements
Where one bad RoleBinding ends the cluster.
Containerised workloads add an entirely new attack surface on top of the cloud provider: image registries, build pipelines, runtime escapes, K8s RBAC, service meshes. Every Macksofy cloud engagement tests it end-to-end — from the Dockerfile your developer pushed last Friday to the kube-apiserver token your CI runner mounted at /var/run/secrets.
- ▸Vulnerable base images + abandoned layers
- ▸Hard-coded secrets / private keys in image history
- ▸Build-pipeline cache poisoning
- ▸Public registry mis-permissions
- ▸Privileged container + host-PID/IPC abuse
- ▸Capabilities + AppArmor / Seccomp bypass
- ▸DinD & socket-mount → host takeover
- ▸Sidecar-to-app trust-boundary violations
- ▸ServiceAccount over-permissioning
- ▸RoleBinding wildcards + namespace breakout
- ▸Kubelet anonymous-auth + exec endpoint
- ▸Webhook / admission-controller abuse
- ▸etcd reachability + secret leakage
- ▸API-server auth bypass + audit-log gaps
- ▸CNI misconfiguration → pod-to-pod lateral
- ▸Persistent-volume cross-tenant exposure
How a Macksofy cloud assessment actually runs.
Five stages, two-to-three weeks for a typical multi-cloud SaaS. We use the same tradecraft a real cloud-savvy attacker would use — never a check-the-box CIS scan read aloud.
- 01Scope & envelope
Account inventory, in-scope services, IaC repos, read-only audit roles, RoE.
1–2 days - 02Enumerate & map
Provider-API enumeration, IAM graphing, K8s discovery, IaC drift analysis.
2–3 days - 03Exploit & chain
IAM privesc paths, SSRF→credential→takeover chains, container escapes, K8s RBAC abuse.
4–6 days - 04Lateral & impact
Cross-account jumps, persistence, sensitive-data demonstration (no exfiltration).
2–3 days - 05Report & retest
Board summary, dev-ready remediation, CIS / NIST / RBI / SEBI evidence, 30-day retest.
3–4 days
Cloud is what we live in, not a service line we added.
Indian regulators are catching up to cloud, attackers are already there, and most audit shops still treat AWS like a colocation cage. Here’s what makes a Macksofy cloud engagement different.
Our cloud reports are accepted as audit evidence by Indian regulators — CERT-In, RBI, SEBI, IRDAI — without rework.
Engagements led by OSCP / OSWE / OSCE-certified testers who have actually compromised production cloud estates. No Nessus-reading interns.
AWS, Azure, GCP, OCI — and the India / UAE regional nuances (data-residency, RBI localisation, NESA / DESC) baked into every finding.
Fix it, ship it, ping us. We re-test every High/Critical free of charge and issue a closure letter your auditor will accept.
What we found in your provider’s defaults.
AWS account audit
Finding · Lambda execution role with wildcard IAM → admin escalation
Critical — patched same week, IaC guardrails added
Pacu. Prowler. Real attacker tooling.
Cloud audit accepted by every framework.
Information security audit empanelled by Indian CERT
RBI Cyber Security Framework + System Audit Reports
Cybersecurity & Cyber Resilience Framework for capital markets
ISMS implementation, internal audit and certification support
Payment card industry — ASV scans, internal audit, pentest
Article 32 controls, DPIA, data flow mapping
Healthcare data protection (relevant for India + UAE health-tech)
UAE National Electronic Security Authority compliance
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things people ask before signing.
Go deeper on cloud security.
- Cloud Security for Indian Enterprises · 2026 (guide)The shared-responsibility line, the misconfigurations that breach, CSPM vs CNAPP, the RBI/SEBI/DPDP/CERT-In stack and a 90-day rollout.
- CSPM vs CNAPP vs CWPP — choosing cloud toolingWhat each acronym actually buys you, and a practical buying sequence for Indian BFSI, fintech and SaaS estates.
- The cloud misconfigurations that fail RBI and SEBI auditsThe specific AWS/Azure/GCP findings auditors flag — public storage, IAM sprawl, weak logging, residency gaps — and how to close them.
- Multi-cloud security for Indian BFSILanding-zone guardrails, data residency under RBI and DPDP, identity blast-radius control, and one monitoring pane across AWS, Azure and GCP.
Where Macksofy delivers Cloud Security.
On-site engagements across India's BFSI, fintech, government and SaaS metros plus the UAE. Senior consultants fly from Mumbai BKC for kickoff, key reviews and exit briefings; remote weeks run through the rest of the engagement.
Macksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements