Who this is for

A SaaS or product team with a live or near-live stack on AWS, Kubernetes, or VPS — and no clear picture of exposure, secrets, or blast radius.

The trigger is a customer questionnaire, a cyber-insurance assessment, an incident scare, or a launch date with no security sign-off.

I review the agreed surface (app, API, IAM, network, CI) and deliver prioritized findings plus what to fix first — or implement fixes when the SoW says so. For multi-cloud estates I use Prowler (open source and Prowler Cloud) on AWS, Azure, GCP, and Microsoft 365.

Tools

Reviews combine manual app and architecture work with automation where it speeds coverage. Prowler is one of the tools I use for cloud posture — the same family I run in production for HDI Cyquins (German cyber-insurance assessments).

HDI Cyquins case on my AWS page

What you get

• ✓Threat-oriented review of app and API surfaces
• ✓Cloud IAM, secrets, and network exposure check
• ✓Multi-cloud scans with Prowler when AWS, Azure, GCP, or M365 are in scope
• ✓Dependency and configuration risk notes
• ✓Prioritized findings (critical → low) with fix guidance
• ✓Executive summary for stakeholders
• ✓Written Statement of Work with fixed price

First step

The call scopes the audit boundary. After that, a bounded Statement of Work with deliverables and price.

Scope

One product or one cloud account: named environments, repos, and attack surfaces.

Deliverables

Written findings, severity ranking, remediation notes, and optional re-test window.

Turnaround

Agreed in the Statement of Work.

Exclusions

Penetration testing beyond agreed scope, 24/7 SOC, and unnamed systems.

Price

On request.