Cloud Penetration Test

Service Overview

The Sophos Cloud Penetration Test methodically evaluates your cloud environment's security through simulation of real-world attack scenarios and adversary behaviors. Our testing framework addresses multiple threat vectors, delivering an in-depth assessment of security gaps, misconfigurations, and vulnerabilities that could be leveraged by sophisticated threat actors.

Cloud Penetration Testing is organized into three offerings, each representing a distinct attacker perspective:

• Cloud Attack Surface Assessment — what an attacker can see and reach before compromising anything (before the breach)
• Cloud Assumed Breach — what an attacker can do once an account, credential, or resource is already compromised (after the breach)
• Cloud Custom Assessments — advanced, cloud-specific engagements outside the standard attack surface and breach scenarios

To conduct these tests effectively, certain levels of access and information are required, such as access accounts (such as Reader accounts and developer accounts), credentials for service principals, and technical infrastructure like remote testing appliances and VPN connectivity. Below is a detailed overview of each offering, the real-world scenarios it represents, and the access or information needed to execute it.

Cloud Attack Surface Assessment — (Before the Breach)

1 week per module

A modular assessment of what your cloud environment exposes to an attacker who has not yet gained a foothold. Customers can select one, two, or all three modules.

Module	Access or Information Required	Objective	Real-World Scenario
External Cloud Exposure	None. Conducted entirely from an external perspective without any internal access or credentials.	Simulate an external attacker with no authenticated access attempting to gather information about your cloud environment, identifying publicly accessible resources and information that could be leveraged to mount an attack across your AWS, Azure, and GCP infrastructure.	An unauthenticated attacker on the internet searches for exposed cloud resources or leaked information that could provide a foothold into your cloud infrastructure, using automated tools and manual searching to scan for misconfigurations, open ports, and publicly accessible data.
Configuration & Posture Review	Read-only Reader account access to the in-scope cloud environment(s).	Review cloud configuration and security posture against best practices to identify misconfigurations, excessive permissions, and gaps in baseline controls.	A customer wants independent validation of their cloud hardening before an audit or after a major infrastructure change. This review identifies misconfiguration gaps before an attacker locates and exploits them.
Conditional Access Testing	Test User Accounts with policies applied, including various roles and access levels. Conditional Access Policy Configurations (Reader account).	Evaluate the effectiveness of Entra ID Conditional Access policies in preventing unauthorized access and assess whether they can be bypassed.	An attacker attempts to access sensitive resources by circumventing conditional access policies, possibly by spoofing trusted locations or devices, or by abusing legacy authentication.

Cloud Assumed Breach — (After the Breach)

1 week per role/objective

A single objective-based engagement that assesses the impact of an already-compromised identity or resource in your cloud environment. Sophos and the customer agree on the specific objective(s) to pursue during scoping, and Sophos simulates the corresponding post-compromise attacker activity.

Access or Information Required: Varies by agreed objective — typically includes credentials for a compromised account (developer, low-privileged user, service principal, or IAM role), and may include on-premises network access via a Remote Testing Appliance for hybrid pivot objectives.

Objective: Assess the risk and potential impact of an already-compromised identity or resource in your cloud environment, including privilege escalation, lateral movement, and pivoting between cloud and on-premises systems.

Real-World Scenarios covered by this engagement include:

• Compromised developer or low-privileged user credentials, and the privilege escalation or data access an attacker could achieve from that starting point
• A compromised Azure service principal or AWS IAM role, and the risk of escalation to higher-privilege roles
• Cross-account access abuse within an AWS Organization
• Lateral movement from a compromised on-premises resource into cloud systems via hybrid connectivity (DirectConnect, ExpressRoute, Cloud Interconnect), or from a compromised cloud resource back into the corporate network

The specific objective(s) in scope are agreed with Customer during the scoping/kickoff call.

Cloud Custom Assessments

2 weeks per objective, on request

Advanced, cloud-focused assessments for needs outside the standard Attack Surface and Assumed Breach offerings, including:

• CI/CD pipeline review
• Copilot / AI testing
• Other custom cloud engagements, scoped on request

Service Methodology

The Sophos Cloud Penetration Test methodically evaluates your cloud environment's security by simulating real-world attack scenarios, adversarial behaviors, and advanced lateral movement techniques appropriate to the offering(s) selected.

Pre-Engagement Planning & Scoping

Sophos initiates testing with a collaborative kickoff to align on objectives, risks, and logistics. This phase ensures minimal disruption to operations while maximizing test efficacy, and — for Cloud Assumed Breach — is where the specific objective(s) are agreed.

• Scope Finalization: Define cloud accounts, hybrid connections, and APIs in-scope (e.g., AWS Organizations, Azure Subscriptions), and confirm which offering(s) and modules/objectives apply.
• Access Coordination: Establish credential requirements (e.g., developer accounts, service principal keys) and deploy Remote Testing Appliances (RTAs) for hybrid attack simulations.

Cloud Reconnaissance & Enumeration

Sophos conducts unauthenticated and credentialed discovery to map attack surfaces in your cloud environment. This phase identifies exposed services, misconfigured resources, and credential leakage risks:

• Unauthenticated Scans: Probe for public-facing storage (S3 buckets, Azure Blobs), exposed APIs, and metadata services (e.g., AWS IMDSv1).
• Credentialed Audits: Map IAM roles, Entra ID Conditional Access policies, and overly permissive network security groups.
• Service Enumeration: Use tools like ScoutSuite, Pacu, and custom scripts to interrogate cloud APIs for weaknesses such as unsecured databases, DNS vulnerabilities, or GitHub token exposures.

Examples:

• Identifying public Kubernetes pods with unprotected dashboards
• Enumerating Azure AD app registrations with excessive Graph API permissions

Assumed Breach Scenarios & Lateral Movement

Sophos simulates post-compromise activities to evaluate how attackers might escalate privileges or pivot across hybrid and multi-cloud environments:

• Credential Theft: Extract secrets from vaults (AWS Secrets Manager, Azure Key Vault) or environment variables.
• Role Escalation: Abuse trust relationships (e.g., AWS AssumeRole, Azure Management Groups) to gain administrative access.
• Hybrid Pivots: Use federated identities (e.g., Azure AD Connect) to move from cloud to on-premises systems.

Examples:

• Using stolen GCP service account keys to bypass Organization Policy constraints
• Exploiting misconfigured VPC peering to access restricted subnets

Exploitation & Privilege Escalation

Leveraging enumerated vulnerabilities, Sophos emulates adversarial exploitation techniques to demonstrate business impact:

• IAM Abuse: Assume overly permissive roles to deploy backdoors (e.g., malicious Cloud Functions) or exfiltrate data.
• Workflow Compromise: Attack CI/CD pipelines (e.g., GitHub Actions, Azure DevOps) to inject malicious code.
• Serverless Exploits: Exploit insecure Lambda layers or Azure Functions for remote code execution.

Examples:

• Exploiting AWS SSM Agent misconfigurations to execute arbitrary commands on EC2 instances
• Bypassing GCP Identity-Aware Proxy (IAP) to access internal web apps

Remote Retest

Sophos will conduct one (1) remediation validation ("RV") for only the high- and critical-severity findings listed in the final report. After primary test completion, Customer has ninety (90) days in which to remediate issues, schedule the RV, and have Sophos perform the RV. Customer must submit the RV request through email to the Sophos point of contact for the assessment within thirty (30) days of delivery of the final report or the RV is forfeited.

For external penetration tests, findings discovered after pivoting and post-exploitation can be difficult to validate and are therefore not included in RV. For internal penetration tests, RV can only be performed if the original test used the Sophos RTA.

Sophos will issue a brief report summarizing the results of the RV, which will include information about whether Customer successfully remediated the issues.

Note Sophos only conducts RVs remotely, regardless of whether the assessment was conducted on-site.

Outcome

Presentation of findings and deliverables compiled by Sophos will be provided to you in the form of a report. The report will include the following:

• Executive summary
• Methods, detailed findings, narratives, and recommendations, if any
• Attachments as needed for relevant details and supporting data

Customer shall have one (1) week from delivery of the report to provide comments to be included in the final report. If there are no comments received from Customer before the expiration of the review period, the report will be deemed final.

Upon completion of the Services, the Customer-designated contact will receive a secure/encrypted email confirmation from Sophos. Unless otherwise notified in writing to the contrary by the Customer designated contact, within five (5) business days of such email confirmation, the Services and this SOW shall be deemed complete.

Scoping information

Cloud Penetration Testing focuses on the offering(s) — and, where applicable, the modules or objectives within them — selected by the Customer.

Offering	Duration
Cloud Attack Surface Assessment — External Cloud Exposure	1 week per module
Cloud Attack Surface Assessment — Configuration & Posture Review	1 week per module
Cloud Attack Surface Assessment — Conditional Access Testing	1 week per module
Cloud Assumed Breach	1 week per role/objective
Cloud Custom Assessments (e.g., CI/CD pipeline, Copilot/AI)	2 weeks per objective

While we do perform some OSINT to find undocumented assets associated with the customer, no live testing of those systems will be performed without written approval. Any modifications to scope will be discussed and documented with Customer before proceeding and may incur additional fees through a Change Order.

Cloud Penetration Testing relies on an objective-based methodology adhering to an artificially compressed timeline. Supplying additional information allows for efficient testing which can remain focused on impactful results. Providing a set of valid credentials for a specified test account allows Sophos to perform more accurate testing, and to configure tooling for the most efficient testing possible.

Work is conducted during business hours of the Sophos consultant. After-hours feature is available for an additional cost.

Scheduling and Booking Information

See Service Scheduling for information about scheduling this service.