Data to Clarity

Cloud Security Assessment

Find out whether your cloud is built the way it should be. We assess your OCI and AWS estates against 214 controls, validate every finding by hand, and hand back a report your engineers can act on and your auditors can accept.

Read-only throughout. No agents, no configuration changes, no write calls. The assessment cannot disrupt production.

Request an assessment See how it works

Interactive demoTry it yourself: from scope to evidenced findingClick through the three steps below.

Control catalogue

Choose the cloud, then the control sets to assess. The published benchmark is the floor; OneGlobe extended controls close the gaps it leaves open.

0 controls selected

Illustrative preview with sample data.

A clean benchmark score is not the same as a secure cloud

Most cloud security reviews arrive as a scanner export: hundreds of rows, no evidence, no severity that reflects your business, and no clear instruction on what to fix first. Teams end up triaging the report instead of fixing the estate.

	A typical scanner report	With OneGlobe
What is checked	The published benchmark only, which is account-level and deliberately shallow	The CIS benchmark for each cloud, plus OneGlobe extended controls covering per-resource exposure the benchmark omits
How findings are produced	Tool output passed through unchecked	Every failed control validated by hand before it reaches the report
Control counting	Row counts inflated by splitting one parameterised check across many lines	Consolidated, with exclusions published and the reason given
What you can do with it	A list of problems	Evidence, severity, the API call behind each finding and the step to fix it
Risk to production	Agents installed, credentials with write access	Read-only access, no agents, no configuration changed

214 controls across two clouds

The same methodology runs against both estates. A published benchmark forms the floor, and OneGlobe extended controls cover what those benchmarks are known to leave out. Controls are numbered separately per cloud, so no identifier is ambiguous across the two reports.

102OCI controls

112AWS controls

2CIS benchmarks applied

0write calls made

Oracle Cloud Infrastructure — by domain

Identity, networking, compute, storage, database, logging and monitoring, and asset management.

Amazon Web Services — by domain

Includes the CIS monitoring section, which most assessments leave as manual review.

From read-only access to audit evidence in five steps

Access

You provide read-only credentials. We take a resource inventory and confirm scope in writing.

Assess

Every control runs against live APIs. No agents, no configuration change, no write calls.

Validate

Every failed control is verified by hand. No finding is reported on tool output alone.

Rate

Severity is assigned against your actual exposure and blast radius, not generic scoring.

Report

Technical report, executive summary, prioritised remediation plan and supporting evidence.

What the assessment covers

The published benchmark, in full

The CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.0 and the CIS Amazon Web Services Foundations Benchmark v5.0.0, applied completely rather than sampled.

Extended controls where the benchmark stops

Public exposure of compute and storage, file storage export rules, database reachability over public channels, pre-authenticated requests, cross-tenancy and cross-account trust, and customer-managed key coverage.

Identity and privileged access

MFA enforcement, long-lived credentials, key rotation, root and tenancy administrator usage, and policies granting more than they need.

Network exposure

Security lists, network security groups, security groups and NACLs, checked per resource rather than per account.

Logging and alerting

Audit logging, flow logs, and alerting on configuration change, including the CIS monitoring chain that most assessments leave as manual review.

Encryption and key management

Encryption at rest, customer-managed keys, key rotation, and the coverage gaps that appear on volumes, backups and snapshots.

Evidence with every finding

Each result carries the exact API call or query that produced it, so any finding can be independently reproduced by your own team.

Severity that reflects your estate

Critical, High, Medium and Low, assigned against real exposure and blast radius rather than a generic score attached to the control.

Root cause, not row count

Where one misconfiguration disables a family of controls, it is reported once with its dependents listed, instead of as a dozen separate criticals.

Repeatable

The same catalogue, run again after remediation, shows exactly what closed and what did not.

What you receive

Two audiences are served from the same assessment run: engineers who need per-control detail, and management who need a defensible risk picture.

Technical report

Every control, its result, the evidence behind it and the remediation step. HTML and Word.

Executive summary

Posture at a glance, risk distribution and the exposures that matter most, in one page.

Remediation plan

Findings sequenced by risk and effort, with quick wins separated from structural work.

Evidence pack

The supporting evidence for each finding, ready to hand to an auditor.

Read-only by design

An assessment should never be the thing that breaks production. Ours cannot, because it has no ability to change anything.

No write access: The assessment makes read API calls only. It installs no agents, deploys nothing into your tenancy or account, and changes no configuration.
Least privilege: Read-only access only: a read-only policy in OCI and a read-only role in AWS.
Negligible load: Read calls impose no meaningful load on your environment, so assessments can run during business hours without a maintenance window.
Rule-based findings: Every control has a defined pass criterion. Findings come from rules, not from inference, and each traces to the exact check that produced it.
Reproducible evidence: Each finding carries the API call or query behind it, so your own team can re-run it and confirm the result independently.
Scope stated up front: This is a configuration and posture assessment. Penetration testing, application security testing, in-guest OS hardening and source-code review are outside the scope.

Built for everyone who has to act on it

Cloud and platform engineersPer-control detail, the evidence behind each finding, and the exact remediation step to apply.
Security and risk teamsA benchmark-anchored posture view across both clouds, with severity that reflects real exposure.
IT leadershipA one-page summary of where the estate stands, what the top exposures are, and what gets fixed first.
AuditorsFindings traceable to a named control and a defined pass criterion, with supporting evidence attached.

Why it is worth doing

A posture assessment is the cheapest security work you will do all year, and the only kind that tells you whether the foundations are sound.

Know where you standA benchmark-anchored answer on both clouds, not an impression.
Fix the right things firstSeverity reflects your exposure, so effort goes where the risk actually is.
No disruptionRead-only throughout. Nothing is installed and nothing is changed.
Findings that survive auditEvery result traces to a named control, a defined criterion and reproducible evidence.
One method, two cloudsThe same approach, the same evidence standard and the same report structure across OCI and AWS.
RepeatableRun it again after remediation to show exactly what closed.
Fast to startRead-only credentials are the only prerequisite. Nothing to deploy, nothing to procure.

Getting started takes one credential

Talk to us

Tell us about your OCI and AWS estates and what is worrying you.

Grant read-only access

A read-only policy in OCI and a read-only role in AWS. Nothing else.

Confirm scope

We take a resource inventory and agree what is in and out, in writing.

Receive the report

Findings, evidence and a prioritised plan, with a walkthrough if you want one.

Frequently asked questions

What does the cloud security assessment cover?

It assesses the configuration and security posture of your Oracle Cloud Infrastructure and AWS estates. OCI is assessed against 102 controls and AWS against 112, covering identity, networking, compute, storage, database, logging and monitoring.

Which benchmarks do you use?

The CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.0 and the CIS Amazon Web Services Foundations Benchmark v5.0.0, plus OneGlobe extended controls that cover gaps the published benchmarks leave open.

Will the assessment change anything in our environment?

No. The assessment is read-only by design. It makes no write calls, installs no agents and changes no configuration. It cannot disrupt production.

What access do you need from us?

Read-only access to each cloud in scope: a read-only policy in OCI and a read-only role in AWS. The exact policy is agreed at scoping.

Is this a penetration test?

No. A penetration test actively attempts to exploit weaknesses. This assessment reads configuration and compares it against benchmark controls. It observes that a port is exposed; it never attempts to connect through it. Penetration testing, application security testing and source-code review are outside the scope.

How long does an assessment take?

A typical single-tenancy, single-account engagement runs over two weeks, from access provisioning to report delivery. The automated scan itself takes minutes. The time is spent on manual validation of every failed control, evidence capture and reporting.

Are findings produced by AI?

No. Every finding comes from a defined rule with a clear pass or fail criterion, and carries the exact API call that produced it. Any finding can be independently reproduced by your own team.

How do you count controls?

We consolidate rather than pad. A parameterised check is one control, not one row per port. We publish what is excluded and why, and where a single root cause disables a family of controls, we report it once with its dependents listed.

What do we receive at the end?

A technical assessment report covering every control with evidence and remediation steps, an executive summary for management, a prioritised remediation plan, and the supporting evidence. Reports are delivered in HTML and Word.

Can you reassess after we have fixed things?

Yes. A re-test cycle verifies remediated findings and produces closure evidence. It is typically run 30 to 45 days after the original report.

Find out how your cloud actually stands

Tell us about your Oracle Cloud and AWS estates. We will scope the assessment, tell you exactly what access we need, and show you what the report looks like before you commit.

Request an assessment