Cloud Security Assessments
See Your Cloud Settings Clearly
Cloud services are only as secure as the way they're set up. Pulsar IT reviews identity, access, logging and configuration across the cloud platforms you use, and gives you a clear, prioritised list of what to fix.
What is Cloud Security Assessments?
Most businesses now rely on cloud services: Microsoft 365 for email and files, and often other platforms such as Microsoft Azure, Amazon Web Services (AWS), Google Cloud or specialist business applications. The provider secures its own infrastructure, but how your account is set up, who has access and what is shared remains your responsibility. This split is often called the shared responsibility model.
A Cloud Security Assessment is a structured, one-off review of those settings. We look at who can sign in and how, who has administrator rights, whether activity is being logged, whether files or storage are shared more widely than intended, and how the configuration compares with recognised good practice.
You receive a prioritised report in plain English, with the technical detail your IT team or provider needs. Fixing the issues is separate work: we can quote for it, or your existing provider can use the report.
Key benefits
- A clear view of who can access your cloud services, and with what rights
- Gaps in multifactor authentication and administrator protection identified
- Over-shared files, storage and links highlighted
- Findings ranked by risk, so effort goes where it matters most
- Practical recommendations your team or provider can act on
How does it work?
We agree which platforms are in scope, review them using read-only access wherever possible, then report back with prioritised findings.
Agree the scope
We confirm which platforms, tenants, subscriptions and applications are included, who your contacts are and how access will be provided securely for the review.
Review the configuration
Using read-only access where the platform allows it, we review identity and access, MFA, administrator roles, logging, storage and sharing, and key security settings against good practice.
Report and prioritise
We explain the findings in plain English, rank them by risk and effort, and walk you through the report so you know what to tackle first.
- Agreed scopePlatforms, accounts and contacts confirmed
- Secure read-only accessProvided during the engagement, not through our website
- Configuration checksIdentity, MFA, admin roles, logging and sharing
- Prioritised reportFindings ranked by risk, with clear next steps
What we review
- Identity and access: user accounts, guest and external users, shared accounts and accounts left behind by people who have left
- Multifactor authentication (MFA) coverage, including any users or apps excluded from it
- Administrator roles: how many people hold them, whether they are separate from everyday accounts and how they are protected
- Sign-in and access policies, such as conditional access, where the platform supports them
- Logging and audit settings: whether activity is recorded, how long it is kept and whether alerts are set up
- Storage and sharing exposure: anonymous or public links, externally shared files and publicly accessible storage
- Connected third-party applications and the permissions they have been granted
- Key security settings compared with recognised good practice and the platform provider's own recommendations
Examples of what we look for
Leavers' accounts still active
Accounts belonging to people who left months ago that can still sign in, sometimes with access to sensitive data.
Too many administrators
Several staff using top-level administrator accounts for everyday work, increasing the damage if one is compromised.
Files shared with anyone
Links that let anyone with the address open business documents, created for a one-off purpose and still active long afterwards.
Logging off or kept too briefly
Audit logging that isn't enabled, or isn't kept long enough, to investigate an incident properly.
Problems solved
Settings untouched since setup
Many cloud accounts were set up quickly and not revisited since. Defaults that suited a small team may not suit the business today.
Unclear who has administrator access
Admin rights tend to accumulate. If you can't list who holds them, you can't be sure they're protected.
Data shared more widely than intended
Public links and external sharing make collaboration easy, and make accidental exposure easy too.
No way to investigate an incident
Without suitable logging, it can be impossible to tell what an attacker accessed after an account is compromised.
Several platforms, no single view
Data spread across Microsoft 365, other clouds and business apps is hard to oversee. The assessment brings the picture together.
What's included
Included as standard
- An agreed list of cloud services and accounts in scope
- Identity, access and MFA review
- Administrator role review
- Logging, storage and sharing review
- Configuration review against good practice
- A prioritised findings report, with a walkthrough of the results
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Fixing the findings, quoted separately
- A deeper Microsoft 365 Security Assessment where Microsoft 365 is your main platform
- Ongoing protection through Microsoft 365 Security
- A follow-up review once changes have been made
What's not included
- Making changes to your cloud services, unless agreed as separate work
- Penetration testing or attempts to break into your cloud services
- Reviewing application code or the cloud provider's own infrastructure
- Platform licences or additional security features needed to apply recommendations
The assessment reflects your configuration at the time of the review. Settings change as people and apps change, so it's a snapshot rather than ongoing monitoring.
What we can review depends on the access provided and the licences and features available on each platform. Any areas we couldn't review are noted in the report.
Who it's suitable for
- Businesses using Microsoft 365 alongside other cloud platforms or applications
- Organisations that moved to the cloud quickly and haven't reviewed settings since
- Businesses running workloads in Microsoft Azure, AWS or Google Cloud
- Companies answering client security questionnaires about their cloud services
- New owners or IT leads who want an independent starting point
Pricing
This service is tailored to your business, so we confirm the price after a short conversation about your requirements. There is no charge for the conversation.
Use the quote builder to add Cloud Security Assessments to an indicative quote, or book a free security review and we'll recommend what fits.
Price
Price Based on Scope
Price to be confirmed following a review of your requirements.
What affects the price
- Platforms in scope
- Number of tenants, subscriptions or accounts
- Number of users and administrators
- Business applications included
- Complexity of the existing configuration
- Reporting and presentation requirements
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Do you need full administrator access?
We ask for read-only or reviewer-level access wherever the platform supports it, arranged securely during the engagement. Please don't send passwords or access details through our website or quote form.
Which platforms can you review?
Typically Microsoft 365, Microsoft Azure, Amazon Web Services and Google Cloud, plus other business applications by agreement. We confirm exactly what's in scope, and any limits, before we start.
How is this different from a Microsoft 365 Security Assessment?
A Microsoft 365 Security Assessment goes deep on Microsoft 365 alone. A Cloud Security Assessment covers several platforms at a broader level, which suits businesses with data in more than one place.
Will the review affect our staff?
It shouldn't. We look at settings and logs rather than changing anything, so people can keep working as normal. Any changes come later, once you've agreed them.
Do you fix the problems you find?
Fixing is kept separate from the assessment, so you get an independent view first. We can quote to make the changes, or your own team or provider can work from the report.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.