Public training
949+ GitHub stars
AWS and Azure attack-path training maintained by the same practice running client cloud reviews.
Cloud, Kubernetes & IAM Security Testing
Scoped testing of cloud infrastructure with a read-only-first approach. We assess IAM, storage exposure, network boundaries, DNS hygiene, and Kubernetes permissions without disrupting production systems.
949+ GitHub stars on our AWS security training.
Operating model
Read-only-first when possible
IAM, storage, DNS, network, and Kubernetes paths are validated without unnecessary production disruption.
Practice record
700+ security engagements
Scoped infrastructure, product, and cloud assessments delivered with clear control-boundary reporting.
IAM Deep Dive
We model how a compromised service account would enumerate roles, trust policies, and federation paths. That attacker behavior drives our testing: we start read-only, then validate escalation and lateral movement routes with scoped, safe checks.
Example finding
A CI role can assume an admin role in a shared services account through an overly broad trust policy. We document the exact policy chain and the least-privilege fix.
Storage & Public Exposure
We follow the same paths an attacker would use after initial access: enumerate buckets, snapshots, images, and registries to see what is reachable without production disruption. That behavior shapes our testing so exposure is verified safely and tied back to clear access policies.
Example finding
A backup bucket is readable by any authenticated cloud user due to a wildcard policy. We map the policy to the impacted data and the minimum fix.
Network & Perimeter
We model how an attacker would move once a workload is compromised: enumerate security groups, route tables, and egress paths to understand what is reachable. That behavior guides our testing, so we validate inbound exposure, confirm egress guardrails, and trace reachable services without disrupting traffic.
Example finding
A permissive security group and open load balancer listener expose an internal service to the internet. We document the exact rule set and the least-disruptive boundary fix.
DNS Hygiene & Takeover Paths
We trace how an attacker would chain DNS records to external services after a team decommissions infrastructure. That behavior drives our testing: we enumerate records across managed DNS, validate live targets, and confirm which routes could be reclaimed, all without touching production workloads.
Example finding
A stale CNAME points to a decommissioned cloud service. We document the exact record, the takeover path, and the safest cleanup step.
Kubernetes: Attacker-in-a-Pod
We model what an attacker can do after landing in a single pod, then use that behavior to drive our testing. We validate RBAC bindings, service account permissions, secrets access, and lateral movement paths, and we tie every check back to the exact control that keeps cluster scope contained.
Example finding
A default service account is bound to a ClusterRole that allows listing secrets across namespaces. We document the binding chain and the least-privilege fix.
Logging, Detection & Benchmarks
We model how an attacker would avoid detection after initial access, then let that behavior shape our testing. We review audit trails such as CloudTrail and Activity Logs, check retention and centralization, and map CIS benchmark gaps to the specific controls that prevent real-world misuse.
Example finding
Org-wide audit trails are not enabled for a subset of accounts, leaving key actions unrecorded. We document the exact logging gap and the least-disruptive path to centralized coverage.
Why teams trust cloud reviews here
Cloud authority is built on public attack-path work
For cloud, Kubernetes, and IAM work, the useful evidence is concrete: escalation paths, control boundaries, and reporting that maps to real infrastructure.
AM
Practice lead
Akash Mahajan
Founder & CEO
Akash leads Appsecco's product security testing practice and the public research behind its methods, labs, and reporting standards.
- 10+ years in product security and 700+ security engagements
- Conference speaker at BlackHat, OWASP, and regional security events
- Author of open-source security training, MCP testing resources, and practitioner checklists
Public cloud research and training
These public artifacts show how the practice models cloud privilege, Kubernetes exposure, and infrastructure attack paths before it ever touches a client environment.
AWS & Azure security training
949+ GitHub starsHands-on training material built around the same cloud attack chains teams need help defending in production.
A Pentester's Approach to Kubernetes Security
Kubernetes researchPublic research on cluster exposure, RBAC, and the attacker-in-a-pod mindset that shapes Kubernetes reviews.
AWS EC2 IMDSv2 versus an Esoteric HTTP Method
Cloud attack analysisAn example of the team's public work on cloud metadata risk, SSRF context, and claims that need careful verification.
Cloud references
Use these references to review reporting standards, client outcomes, and scope framing around real infrastructure controls.
Cloud, Kubernetes & IAM scope hub
Service overviewA route-level view of how IAM, storage, network, DNS, and Kubernetes controls are tested in practice.
Sample report
Evidence formatThe reporting standard buyers can expect once infrastructure findings have to survive engineering and audit review.
Case studies
Client review pathsBroader examples of how scoped testing and clear remediation evidence support internal launch and audit decisions.
What clients say about cloud security testing
Appsecco stands out in the security domain with their exceptional technical expertise across various fields, including Cloud, Kubernetes, application security, and network layers.
Sharanabasava MS
Senior Product Security Engg, Infoblox
Appsecco provided an amazing service with assessment and pentesting and found some really inteersting problems. They also provided solid guidance to our dev team to fix the findings.
Reference-ready next step
Need a cloud-specific reference path before you scope?
We can start from the closest public cloud artifact, reporting example, or case-study trail so platform and security reviewers see the same proof early.
We focus on clarity about the exact control boundaries that matter in your environment, not volume of findings.
Request scoped reviewCloud, Kubernetes & IAM FAQ
What will the final report include for cloud and Kubernetes?
You receive a structured report with an executive summary plus detailed findings tied to IAM, storage, network, DNS, and Kubernetes controls. Each finding includes evidence, impact context, and remediation guidance so internal reviews are straightforward.
How do you provide evidence without risky actions?
We document the exact configuration or policy path that enables the issue and include safe, reproducible steps. Where possible, we use read-only proofs and targeted validation checks that avoid production disruption.
What access do you need, and how is it scoped?
We start with read-only access and specify any targeted permissions needed for validation. The access list is agreed in advance so your team knows exactly what is required and why.
Do you include remediation guidance for IAM and K8s issues?
Yes. We provide least-privilege fixes, safer policy patterns, and configuration guidance for each finding. Every fix is written to be defensible and easy to review.
Can you cover multi-cloud and hybrid environments?
Yes. We map scope by provider and account, then document cross-cloud trust paths and federation points so coverage is clear across environments.
Explore cloud attack paths
Related cloud, Kubernetes, and IAM security resources
Continue from cloud security concepts into infrastructure testing, identity abuse, Kubernetes risks, and cloud attack research.
Glossary
Cloud Security Testing
How cloud environments are reviewed for misconfiguration, exposure, privilege escalation, and attack paths.
Glossary
Kubernetes Security
Risks in cluster configuration, RBAC, workload isolation, network policy, secrets, and cloud-managed Kubernetes.
Glossary
IAM Security
Identity and access controls that shape privilege boundaries, lateral movement, and cloud account compromise paths.
Blog
A Pentester’s Approach to Kubernetes Security - Part 1
Common Kubernetes misconfigurations found during real pentests, including exposed APIs and service-account risks.
Blog
A Pentester’s Approach to Kubernetes Security - Part 2
A deeper look at overprivileged RBAC, cloud IAM mappings, and cluster-to-cloud escape paths.
Blog
Exploiting IAM Security Misconfigurations - Part 1
How attackers abuse IAM trust and policy mistakes to escalate access in cloud environments.
Blog
AWS EC2 IMDSv2 versus an Esoteric HTTP Method
A focused investigation into EC2 metadata protections, SSRF context, and IMDSv2 bypass claims.
Blog
Top 10 Docker Hardening Best Practices
Practical container hardening controls that reduce Docker and cloud-native attack surface.
Blog
A Pentester’s Approach to Kubernetes Security — Part 2
Part 2 of Appsecco's Kubernetes pentest series, focusing on overprivileged RBAC, cloud IAM to Kubernetes mappings, and how attackers escape from cluster to cloud.
Talk through your cloud scope first. No commitment required.
Share the environments and access boundaries you want reviewed. We will outline a read-only-first plan, confirm what we will and will not touch, and provide a fixed quote if it is useful.
Read-only-first approach
Fixed scope, fixed pricing
You decide the pace