# **Cloud Pentest**


:::info
A cloud pentest simulates real-world attacks to identify and exploit weaknesses in your cloud environment based on the OWASP Cloud-Native Application Security Top 10.

:::

Our Cloud Pentest methodology is designed to provide a deep, attacker-simulated assessment of your cloud environment, adhering to the Shared Responsibility Model by focusing on the security of your configurations, data, and applications.

### **What’s Testable: The Shared Responsibility Model**

The shared responsibility model dictates what is testable. Our services focus on the security of the cloud, including your data, applications, operating systems, and configurations. We do not test the security of the cloud itself, which is the responsibility of the cloud service provider. This includes the physical infrastructure and the security of the underlying cloud services.

*Our testing approach is aligned with industry standards and frameworks, including the OWASP Cloud-Native Application Security Top 10, OWASP Testing Guide, and CIS Benchmarks.*

### **Prerequisites**

To ensure a comprehensive and effective pentest, providing the following access is mandatory:

* Credentials and Console Access for the cloud environment.
* Jump Box Setup: A dedicated lightweight Linux server (e.g., Kali Cloud VM) installed within the cloud network.
* Resource Allocation: Recommended resources for the VM are at least 2 virtual CPUs, 8 GB RAM, and 50 GB disk space.
* Access Credentials: Key-based SSH access for each pentester and Root access to the Kali VM.

While most cloud providers no longer require pre-notification for these audits, please refer to the [Cloud Provider Authorization](https://docs.cobalt.io/methodologies/cloud-provider-auth/) documentation for more details.

### **Cloud Pentesting Approach**

Major cloud providers (AWS, Azure, GCP) offer hundreds of specialized services. While the names differ, our testing methodology remains consistent, covering key functional areas:

| Functional Area | Service Examples |
|----|----|
| **Compute** | Azure VMs, GCE, Lambda, Fargate, App Services |
| **Storage** | S3, Blob Storage, GCS, Glacier, EBS, EFS |
| **Databases** | RDS, DynamoDB, Cosmos DB, Cloud SQL, Aurora |
| **Networking** | VPC, NSGs, Security Groups, Route 53, Cloud CDN |
| **Identity & Access** | IAM, Azure AD, GCP IAM, Cognito |
| **Monitoring & Logging** | CloudTrail, CloudWatch, Activity Logs, Stackdriver |

Our testers focus on both the configuration of your cloud environment and the security of services deployed within your infrastructure.

The pentest includes evaluation of access controls, exposed services, secrets management, and cloud-native integrations using relevant OWASP and cloud-specific testing techniques. Simulated attacks are performed to identify weaknesses in IAM roles, trust boundaries, storage permissions, misconfigured services, and other exploitable vulnerabilities specific to your cloud provider. Our testers utilize a wide range of public and proprietary tools tailored to cloud infrastructure testing.

Our pentest follows a structured, four-phase process:


1. Target Scope Reconnaissance
2. Cloud Configuration Review
3. Manual Assessment (Simulated Attack)
4. Reporting, Triaging, and Retesting

### **1. Target Scope Reconnaissance**

Our testers gather intelligence on your cloud environment to define the complete attack surface, which includes:

* **Service and Asset Discovery**: Identification and cataloging of cloud services, instances, storage, serverless functions, and container workloads to establish scope and exposure.
* **Authentication & Identity Management**: Review authentication mechanisms, IAM roles, privilege delegation, and session control across user and machine identities.
* **Business Logic & Data Handling**: Mapping of high-risk workflows and sensitivity of data handled by the environment (e.g., PII in storage buckets, customer data in managed databases).
* **Network Reachability & Filtering**: Evaluation of firewall policies, network ACLs, load balancers, and VPC peering for exposed or misconfigured services.

### **2. Cloud Configuration Review**

Our testers initiate the test with an automated review of your environment against established standards like CIS Benchmarks and industry best practices. This is followed by a manual review to eliminate false positives and accurately assess the severity of findings that automated scanners often miss

### **3. Manual Assessment**

This is the core of the pentest, where testers perform simulated attacks using a systematic approach to identify complex, chained vulnerabilities specific to your cloud infrastructure.

Our testers concentrate on the following high-impact domains:

* **Identity and Access Management (IAM)**: Examine privilege escalation paths, over-permissive roles, missing MFA, and lateral movement opportunities using assumed roles or service principals.
* **Storage and Data**: Analyze cloud storage services (e.g., S3, Azure Blob, GCS) for public exposure, misconfigured access policies, unencrypted data at rest, and weak control over sensitive datasets.
* **Network and Infrastructure**: Review virtual network architecture (VPCs, VNets), firewall rules, routing, and public service exposure to ensure services are appropriately segmented and protected from unauthorized access.
* **Application and API Security**: Assess cloud-hosted applications, serverless functions, and APIs for OWASP Top 10 vulnerabilities, and misconfigured endpoints.
* **Configuration and Secrets Management**: Evaluate secrets handling, including environment variables and key stores, checking for hardcoded credentials and lack of rotation.
* **Monitoring and Resilience**: Test the resilience of monitoring and detection controls (e.g., GuardDuty, Security Center) to identify gaps that could allow attacker activity to go undetected.

**Testing Based on OWASP Cloud**

For each category, testers will assess:

* **Access Control**: Identify flaws that allow privilege escalation, unauthorized resource access, or bypass of policy restrictions. Includes IAM misconfigurations, excessive permissions, and insecure role assumptions.
* **Cryptography**: Assess if sensitive data is exposed due to lack of encryption in storage or transit. Focus areas include unsecured storage buckets, weak SSL/TLS configurations, and misconfigured encryption keys.
* **Misconfigurations**: Identify misconfigured services, open administrative interfaces, publicly exposed storage, disabled monitoring, or unused services increasing the attack surface.
* **Vulnerable and Outdated Components**: Check compute workloads (e.g., EC2, Azure VM, container images) for outdated software, missing patches, and known vulnerabilities via CVE lookups.
* **Credential Leakage and Secrets Management**: Search for hardcoded secrets, plaintext API keys, and credentials in environment metadata or repos. Assess proper use of cloud-native secrets stores and key rotation practices.
* **Service Abuse**: Simulate abuse of autoscaling, misconfigured quotas, or excessive service requests leading to cost spikes, DoS conditions, or availability degradation.


:::info
#### **Tools**

Cobalt pentesters may use tools such as:

* **Cloud Posture Tools: ScoutSuite, Pacu, Prowler, CloudSploit, CloudFox, KICS**
* **Kubernetes Posture Tools: Kube-hunter, Kubesec**
* **API/Web Security: Burp Suite, OWASP ZAP, Postman**
* **Credentials/Recon: TruffleHog, git-secrets, Steampipe, Recon-ng**
* **Custom & Proprietary Internal Tools for advanced IAM and policy abuse testing**

:::

#### **4. Reporting, Triaging, and Retesting**

Cobalt pentesters report and triage all vulnerabilities during the assessment. You can review details of all [findings](https://cobalt-io.brainfish.ai/en-us/articles/findings-6prkG67iav), in real time, through the Cobalt platform. In these findings, as well as in any [report](https://cobalt-io.brainfish.ai/en-us/articles/reports-YkC2da1roR), Cobalt’s pentesters include detailed information, including:

* Step-by-step remediation guidance
* Recommendations on how to improve your overall security posture

You can [remediate findings](https://cobalt-io.brainfish.ai/en-us/articles/remediate-findings-22WPR0Fnlv) during and after the pentest. Then you can submit findings for retest. Our pentesters test the updated components and retest vulnerabilities to ensure that there are no security-related residual risks.

Cloud Pentest Methodology

Cobalt Methodologies Overview

Web Methodologies

API Methodologies

External Network Methodologies

Internal Network Methodologies

Mobile Methodologies

Cloud Configuration Review Methodologies

Desktop Methodologies

AI/LLM Methodologies

Digital Risk Assessment Methodology

Secure Code Review Methodologies

Methodologies

How to get started with Cobalt

Getting Started

Risk Advisories

Assets are what we pentest

Asset Types

Create an Asset

Assets

Pentests

Overview

Asset Details

Pentest Details

Scope & Test Period

Preparation

Create a Pentest

Pentest Process

Pentest States

Coverage Checklist

Pentest Expectations

Set Up an In-House Pentest

Complete an In-House Pentest (For Pentesters)

In House Pentests

Severity Levels

Finding States

Remediate Findings

Findings

Customize Your Report

Co-branded Reports

Contents of a Pentest Report

Reports

Engagements Overview

Digital Risk Assessment

Secure Code Review

Engagements

Insights

Planning

Attack Surface Monitoring (ASM)

Attack Surface

DAST Scanner Overview

Best Practices

Integrations

Partial Scans: Reduced Scope

Scans

Sequence recorder

Targets

Target Authentication

Extra Hosts

Blackout Period

DAST Scanner

Account Overview

Account Settings

Password Best Practices

Sign In to Cobalt

Troubleshoot Sign-in Issues

User Account

Collaboration Overview

Collaborate on Pentests

Groups

Manage Pentest Collaborators

Manage Notifications

User Roles and Permissions

Collaboration

Organization Overview

Manage Users

Your Cobalt Contract

How to Configure SAML 2.0 for Cobalt 

SAML Migration: Update Your Configuration

Configure SAML SSO

SCIM Provisioning Setup Guide

Configure Organization Settings

Organization

Cobalt Credits

Track Your Credits

Cobalt PtaaS Tiers

Credits

Cobalt Integrations Overview

Connect your applications

Create GitHub tickets for Findings

Send MS Teams notifications for Findings

Create Azure DevOps Work Item for Findings

Create Jira tickets for Findings

Send email notifications for Findings from Outlook

Create GitLab tickets for Findings

HTTP Connector

Import Assets from Google Sheets

Map Cobalt Pentest Finding Severity to Jira Issue Priority

Modify Jira Issue Summary to contain Pentest Title

How to Guides

Troubleshooting

Integration Builder

Jira Data Center Integration

Push Cobalt Findings to Jira

Switching to a New Jira Instance

Jira Cloud Integration

Troubleshoot Your Jira Integration

Synchronize Cobalt Severity Levels with Jira

Integrate Jira with Cobalt

Slack

Microsoft Teams

Webhooks

DefectDojo

Kenna Security

Vanta

Carried Over Findings

Create Test Finding

Cobalt API Overview

Partner Integrations

API Versions

Events

Errors

Subscription

Introduction

Authentication

EU Data Center

Organizations

Engagement Findings

DAST Targets

DAST Scans

DAST Scheduled Scans

DAST Findings

External Ticket References

Tokens

Pagination

Idempotency

Rate Limits

Create a Personal Cobalt API Token

Changelog

Get an Organization Token

Revoke Your Personal Cobalt API Tokens

Create or Modify an Asset

Import Findings to Google Sheets

Cobalt API

Glossary

March 2026

February 2026

January 2026

November 2025 

August 2025

July 2025

June 2025

May 2025

April 2025

March 2025

January 2025

December 2024

November 2024

October 2024

September 2024

August 2024

July 2024

June 2024

May 2024

April 2024

March 2024

January 2024

What's New

Guide

Cobalt Product Documentation