Cyber Defense
Cloud security testing services in India are still frequently sold as a network scan pointed at an AWS account. That finds open ports. It does not find the read-only role that can assume a second role that can read every bucket, which is how cloud environments are actually taken apart.
In a data centre, the attacker moves through the network. In AWS, Azure and GCP, they move through identity. Our testing follows that: we enumerate roles, policies, trust relationships and service accounts, then trace what each principal can reach through the chain of things it is allowed to assume, attach or invoke.
Configuration review and penetration testing run together, because a misconfiguration matters only in proportion to what it exposes. Where your workloads are containerised we cover the cluster; where identity is federated with your directory, see identity and access management. If you are testing cloud for a certification, ISO 27017 is the cloud-specific control set.
Why you need it
01 / 06Each policy was reasonable when it was written. The graph they form is not, and no one has ever read all of it. Effective permission (what a principal can actually reach after every assume, attach and pass) is computed, not reviewed by eye.
One over-permissioned CI runner, one leaked long-lived access key, one instance-profile credential reachable from a server-side request forgery, and the boundary that mattered was never the network at all.
Public object access, permissive security groups, unencrypted volumes and snapshots, logging switched off, default service accounts with project-wide roles; the platform will let you, and will bill you happily either way.
The provider secures the infrastructure; the configuration, identity model and data are yours. ISO 27017, SOC 2 and PCI DSS assessors ask for evidence of the half you own, and a provider compliance page is not that evidence.
Instrument
02 / 06Toggle a single over-permissioned path and watch the reachable set expand. The argument for least privilege, drawn rather than asserted.
What we deliver
03 / 06Every role, policy, group, trust relationship and service account in scope, resolved into effective permissions. Privilege-escalation paths, cross-account trust, wildcard actions and resources, unused long-lived keys, and the principals that can quietly become administrators.
Storage exposure, encryption at rest and in transit and who holds the keys, network security groups and firewall rules, public endpoints, logging and monitoring coverage, and backup and retention configuration, benchmarked against CIS and the provider's own well-architected guidance.
What an unauthenticated attacker on the internet reaches, and then, from an assumed foothold, what a compromised workload reaches: metadata service access, credential theft from instance profiles, lateral movement between subscriptions or projects, and segmentation that exists in the diagram but not the security group.
Cluster configuration and RBAC, pod security standards, network policies, secrets handling, container escape paths, image provenance and registry access, and the admission controls that would have prevented the deployment in the first place.
Function permissions and event-source trust, environment-variable secrets, API gateway authorisation, queue and topic access policies, and managed database exposure, the parts of the estate that no agent-based tool ever sees.
AWS, Azure and GCP under one assessment where you run more than one, plus the federation and directory synchronisation that joins them to your on-premise identity, usually the least examined and most valuable path in the estate.
How we run it
04 / 06Your architecture, your providers, what the environment is for, and what would genuinely hurt if it were reached. This shapes what we test hardest rather than what we test at all.
Week 0Accounts, subscriptions and projects in scope, the read-only audit role we need, testing windows, production constraints, and a written escalation contact. Provider testing policies are checked and any required notification is handled before day one.
Week 0Automated posture assessment with ScoutSuite and Prowler, then manual review of identity and network configuration, because the interesting findings are the combinations the tools rate individually as low.
Days 1-3Workload and image scanning across compute, containers and functions, plus external exposure testing of every public endpoint the account actually presents, several of which are usually a surprise.
Days 3-4Exploitation under written authorisation: privilege escalation through the permission graph, credential access from compromised workloads, cross-boundary movement, and data reach. Chains are the deliverable, not individual misconfigurations.
Days 4-8Findings with the exact resource identifiers and policy documents involved, ranked by what they reach, plus infrastructure-as-code remediation where your estate is managed that way. Re-tested after you fix.
Days 9-10, then re-testKey benefits
05 / 06Not a list of policies, but a map of what each principal can ultimately reach, and the handful of edges whose removal collapses most of it.
Public storage, forgotten endpoints, orphaned keys and unused roles are enumerated and closed, with a repeatable check so the same drift is caught next quarter.
Configuration baselines, test scope and method, findings and verified remediation, the package ISO 27017, SOC 2 and PCI DSS assessors ask for on the customer side of the shared responsibility model.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Posture and configuration
Identity and permission graphing
Exploitation
Containers and workloads
Benchmarks
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.