99% of cloud breaches are caused by misconfiguration, not zero days
Most IAM roles have permissions never used
Public S3 buckets remain the most common cloud finding
Kubernetes RBAC failures escalate to cluster admin in minutes
Shared responsibility — but only one of you gets breached
The cloud config you signed off on isn't the one running today
99% of cloud breaches are caused by misconfiguration, not zero days
Most IAM roles have permissions never used
Public S3 buckets remain the most common cloud finding
Kubernetes RBAC failures escalate to cluster admin in minutes
Shared responsibility — but only one of you gets breached
The cloud config you signed off on isn't the one running today
The Reality
Cloud doesn't fail the way your network fails.
Network pen testing was built for hosts, ports and patches. Cloud breaks in fundamentally different ways — through identity, configuration and the seams between services. The shared responsibility model means most cloud risk lives in your config, not the provider's infrastructure. And cloud changes faster than any annual test can keep up with.
Identity is the new perimeter
Over-permissioned IAM roles, dormant access keys, federated trust paths and assume-role chains are how cloud compromise actually happens. Most network pen testers don't look here. Most cloud security posture tools don't actually test exploitability.
Misconfiguration is the entire attack surface
Public storage buckets, exposed Kubernetes API servers, default credentials in container images, secrets in code repos. None of this looks like a CVE — but all of it looks like a breach when an attacker finds it.
CSPM tells you what's wrong, not what's exploitable
Posture management surfaces hundreds of findings. Most are noise. Pen testing tells you which ones actually chain into compromise — and which fixes will close multiple findings at once.
Cloud changes daily — annual tests don't
A new IAM role, a new container deployment, a new federation trust — cloud configurations drift constantly. Last quarter's pen test passed because last quarter's config was different. Continuous testing is the only way to keep up.
// The Numbers
"NodeZero compromised cloud admin via an over-permissioned IAM role chain — the customer had passed a SOC 2 audit that quarter."
Cloud breaches caused by misconfiguration
~99%
IAM permissions never used in 90 days
most
Days a cloud pen test report stays current
~30
Coverage of a typical cloud audit
posture, not exploit
Two Delivery Paths · One Programme
Autonomous depth, human assurance.
Endida delivers cloud penetration testing through two complementary paths. NodeZero runs continuously across AWS, Azure and Kubernetes — daily, weekly or on-demand. CREST-certified specialists step in for engagements where accreditation, custom-built application logic or regulator sign-off is required. Most clients run both.
Path 01 · Continuous
NodeZero Autonomous Cloud Testing
Continuous, production-safe cloud penetration testing powered by NodeZero (Horizon3.ai). Find exploitable attack paths across AWS, Azure and Kubernetes — every day, not once a year.
First findings within hours — no setup, no consultant scheduling
AWS, Azure and Kubernetes coverage on a single platform
IAM analysis — over-permissioned roles, dormant keys, escalation paths
Hybrid testing — chains cloud weaknesses with on-prem network paths
Production-safe benign exploitation — runs alongside live workloads
Unlimited tests on subscription — schedule daily, weekly or on-demand
1-click fix verification — prove every remediation actually worked
Free trial — full results, no card required
// Best for
Cloud-native and hybrid-cloud organisations that need continuous coverage as IAM and infrastructure change. The default choice for SaaS, fintech and any team running modern DevOps cycles.
Path 02 · Specialist
CREST-Certified Specialist Cloud Testing
Human-led cloud penetration testing delivered by CREST-certified, CBEST and TIBER-approved testers. For engagements that demand accredited expertise, application logic depth or formal regulator sign-off.
CREST-certified testers — recognised by regulators, insurers and auditors
Custom cloud applications and bespoke serverless architectures
Cloud-hosted business logic flaws and authorisation chains
Adversary simulation against cloud-hosted critical workloads
CBEST, TIBER-EU and DORA TLPT cloud-scope engagements
CREST sign-off available on NodeZero autonomous output
Formal report suitable for SOC 2, ISO 27001, FedRAMP audits
Re-testing of remediated findings included
// Best for
Regulated industries, SOC 2 / FedRAMP / ISO 27001 audits requiring named tester involvement, custom-built cloud applications, and any engagement where human depth on application logic is required.
What's Tested
Full cloud coverage — identity, infrastructure, containers.
Endida cloud pen testing covers every layer an attacker would target across modern cloud environments — from identity and access, through cloud-native services, to container orchestration and the hybrid seams that connect cloud to on-prem.
01 · AWS
AWS penetration testing
Tests AWS environments end-to-end — IAM role chains and assume-role paths, S3 bucket exposure, EC2 instance metadata, Lambda and serverless misconfigurations, exposed secrets, and the cross-account trust relationships attackers exploit to pivot between accounts.
02 · Azure
Azure penetration testing
Tests Microsoft Azure environments — Entra ID (Azure AD) misconfigurations, conditional access bypasses, role assignments, storage account exposure, key vault access, federated trust to on-prem AD, and the Azure-to-365 attack paths that link cloud compromise to email and data exfiltration.
03 · Kubernetes
Kubernetes penetration testing
Tests Kubernetes clusters across EKS, AKS, GKE and self-managed deployments — RBAC misconfigurations, exposed API servers, kubelet access, container escape paths, pod security violations and the service account abuse that escalates from a single pod to cluster admin in minutes.
04 · Cloud IAM
Identity and access
Identity is now the cloud attack surface. Endida tests over-permissioned roles, dormant access keys, weak MFA enforcement, federated trust paths, group nesting, privilege escalation chains, and the MFA-fatigue and consent-phishing techniques attackers use to compromise human identities.
05 · Hybrid Cloud
Hybrid cloud paths
The interesting attacks chain cloud and on-prem. NodeZero tests hybrid attack paths — from a phished cloud identity to on-prem domain admin, or from a compromised on-prem host to your AWS or Azure tenant. The seams are where most real-world breaches happen.
06 · Cloud Apps
Cloud-hosted applications
Tests cloud-hosted applications at the intersection of code and configuration — exposed APIs, misconfigured load balancers, secrets management failures, container image vulnerabilities, and the application-layer flaws that turn cloud infrastructure into actual data exfiltration.
How NodeZero Works
The Find. Fix. Verify. loop, in cloud.
NodeZero thinks and moves like a real cloud attacker — chaining IAM weaknesses, misconfigurations and exposed services without scripts or pre-defined playbooks. Then it shows you exactly what to fix, in priority order, and proves your fixes worked.
01
Find
Autonomous cloud attack execution
NodeZero pivots through your cloud environment exactly as an attacker would — assuming roles, exploiting misconfigurations, escalating privileges, chaining IAM and infrastructure weaknesses across AWS, Azure and Kubernetes. No agents required, no scripts. Real-time visibility into every exploit.
02
Fix
Prioritised cloud remediation
The platform surfaces the cloud attack paths with greatest business impact first. Step-by-step exploit chains show exactly how compromise happened — and which single fixes (a tightened IAM policy, a corrected RBAC binding) resolve multiple attack paths simultaneously.
03
Verify
1-click fix verification
Tightened a role? Closed a public bucket? Patched a Kubernetes RBAC rule? Verify the fix immediately with a targeted retest — no full pen test required. Track MTTM and MTTR. Show the board cloud risk reduction over time, not a snapshot.
Sample Reports
See exactly what you receive — before you commit.
Two official Horizon3 NodeZero demonstration reports built on a representative test environment. The pen test report shows what was found and how it was exploited. The fix actions report shows exactly what to fix, prioritised by severity. Same report format you'll receive after a free trial against your own environment — covering both cloud and infrastructure findings.
Sample · 346 Pages · PDF
NodeZero Pen Test Report
An official Horizon3 NodeZero demonstration report built on a representative test environment. Shows the executive summary, top impacts including domain compromise, weakness analysis and full attack path detail — exactly the format you'll receive after a free trial against your own environment.
Executive summary with top business impacts
Domain compromise via 36 attack vectors (with named CVEs)
Cloud findings — Azure MFA, AWS IAM, Kubernetes API exposure
MITRE ATT&CK mapping and systemic issue analysis
Full credential and weakness inventory
Sample · 187 Pages · PDF
NodeZero Fix Actions Report
The companion fix actions report. Findings organised by severity (Critical / High / Medium) with step-by-step remediation guidance for each. Engineering teams know exactly what to do — no triaging required.
Critical findings — RCE, AD CS, NTLM relay, Citrix Bleed
Cloud findings — Azure MFA disabled, AWS Assume Role, Kubernetes RBAC
High findings — credential dumping, GPP passwords, weak service auth
Step-by-step remediation per CVE
Severity-ordered for engineering teams
// Official Horizon3 demonstration reports — built on a representative test environment, not a real customer
The Difference
CSPM vs. cloud penetration testing
Cloud Posture / CSPM Alone
comparison
Endida Continuous Cloud Pen Testing
Lists hundreds of findings — most aren't exploitable
Tests which findings actually chain into compromise
Tells you a config is non-compliant
Proves an attacker can use it to reach data
Same severity labels for everything — analyst burnout
Attack-path prioritisation — fix highest impact first
Can't see across IAM + infrastructure + containers
Chains IAM, infrastructure, container and on-prem paths
No verification a fix actually closed exploitability
1-click verify confirms each fix worked
Stops at the cloud boundary
Tests hybrid paths — cloud to on-prem and back
Compliance evidence, not breach evidence
Both — exploitability proof for board, audit and insurer
CSPM and cloud pen testing are complementary, not competitive. CSPM gives you posture coverage; pen testing gives you exploitability proof. Endida offers both — but if you can only invest in one, pen testing tells you what's actually breachable.
When You Need This
Six common reasons clients bring us in.
SOC 2 and ISO 27001 audits
Cloud pen testing supports SOC 2 (CC4.1, CC7.1), ISO 27001:2022 (A.8.8), PCI DSS, FedRAMP and most cloud-native compliance frameworks. Continuous testing satisfies cadence requirements; CREST-certified engagements satisfy accreditation requirements where required.
Cloud migration sign-off
Migrating to AWS, Azure or Kubernetes? A pen test before go-live catches the IAM, RBAC and exposure issues that always emerge in the move. Continuous testing afterwards keeps the configuration honest as the environment evolves.
Cyber insurance renewal
Insurers now scrutinise cloud security as closely as on-prem — and require demonstrable, recent testing. Continuous cloud pen testing, with CREST sign-off available, gives underwriters the assurance they need to renew on favourable terms.
Customer security questionnaires
Enterprise customers and procurement teams now ask for evidence of recent cloud pen testing — not annual reports. Continuous testing means you can answer "yes, last week" instead of "yes, last September" — and unlock deals that hinge on it.
Validating CSPM findings
Your CSPM tool is showing 1,200 findings. Most won't actually breach anything. Cloud pen testing identifies which ones are exploitable, which ones chain together, and where to focus remediation effort first.
DevOps velocity, audit anxiety
Engineering ships cloud changes daily. Annual pen testing can't keep up. Continuous cloud pen testing means new IAM roles, new Kubernetes deployments and new federations are tested as they go live — not 11 months later.
What Security Teams Say
"
Our CSPM gave us 800 findings. NodeZero showed us the 12 that actually chained into cloud admin. That's the report engineering paid attention to.
"
Before NodeZero we had no way to validate whether cloud remediations actually worked. Now we run retests, track risk reduction, and report outcomes — not promises.
"
We use the results to brief our board. They understand the cloud risk because it's real — not theoretical. They see the trend, not just one bad week.
Common Questions
Cloud pen testing — frequently asked.
What is cloud penetration testing? +
Cloud penetration testing is a controlled simulation of a real-world cyber attack against your cloud environment — AWS, Azure, Kubernetes and the identity infrastructure that connects them. The goal is to identify exploitable weaknesses such as IAM misconfigurations, over-permissioned roles, exposed storage, container escape paths, secrets in code and lateral movement opportunities, before a real attacker does. Endida delivers cloud pen testing through continuous autonomous testing via NodeZero, or through CREST-certified specialist testers when accredited human depth is required.
Do AWS and Azure allow penetration testing? +
Yes. Both AWS and Microsoft Azure permit customer-led penetration testing of resources in their accounts without prior approval, subject to their respective rules of engagement. AWS publishes a customer support policy covering permitted services. Microsoft maintains the Cloud Penetration Testing Rules of Engagement. Endida's testing is designed to operate within these policies and is production-safe by design — runs alongside live workloads without performance impact.
What does cloud pen testing cover that traditional network testing misses? +
Cloud environments fail in fundamentally different ways. Traditional network testing focuses on hosts, ports and services. Cloud testing focuses on identity (IAM roles, policies, federation), control plane misconfigurations (S3 buckets, storage accounts, key vaults), serverless functions, container orchestration (Kubernetes RBAC, pod security), and cross-account or cross-tenant lateral movement. The shared responsibility model means much of cloud risk sits in configuration, not infrastructure — and traditional testing rarely covers it.
Is autonomous cloud penetration testing safe to run on production? +
Yes. NodeZero is production-safe by design. It performs benign exploitation — proving exploitability without causing harm or disruption — and uses safe execution defaults throughout every test. It runs alongside live cloud workloads without affecting performance, availability or stability. The vast majority of NodeZero deployments run directly against production cloud environments.
Does Endida's cloud pen testing meet SOC 2, ISO 27001 and CREST requirements? +
Yes. Cloud penetration testing supports SOC 2 (CC4.1, CC7.1), ISO 27001:2022 (A.8.8), PCI DSS, FedRAMP and most cloud-native compliance frameworks. Endida provides CREST-certified specialist cloud penetration testing for engagements that require accredited human testers, and CREST sign-off on autonomous NodeZero output for regulated clients. Reports are formatted for direct submission to auditors and regulators.
How is cloud pen testing different from CSPM? +
Cloud Security Posture Management (CSPM) tells you what's misconfigured. Cloud penetration testing tells you what's exploitable. Most CSPM tools surface hundreds or thousands of findings without prioritisation — the majority aren't actually reachable by an attacker. Pen testing chains misconfigurations together to show which ones lead to real compromise, which fixes close multiple paths at once, and where to focus engineering effort first. The two are complementary — Endida offers both — but if you have to choose one, pen testing tells you what actually matters.
How quickly can a cloud pen test start? +
An autonomous cloud pen test via NodeZero can be operational within minutes. Cloud tests run directly from the NodeZero platform — no agents, no host setup, just IAM credentials with appropriate read-only permissions for discovery. First findings are typically delivered within hours of launch. Specialist CREST-certified engagements are scoped within one business day and started within one to two weeks depending on scope and tester availability.
What about hybrid cloud environments? +
Most real-world cloud breaches involve hybrid attack paths — chains that move between cloud and on-prem. NodeZero is designed to test these paths end-to-end. A phished cloud identity might lead to on-prem domain compromise via federated trust; a compromised on-prem host might pivot into your AWS or Azure tenant via stored credentials or access keys. Endida tests both directions on a single platform, surfacing the seams where most breaches actually happen.
Where does Endida operate? +
Endida is headquartered in Dubai (DIFC) with operations in the UK and Channel Islands. We actively serve regulated organisations across the UK, EU, MENA and globally — particularly iGaming, crypto and financial services clients in Malta, Gibraltar, the Channel Islands and other European regulated jurisdictions. Our coverage spans UK and EU regulatory frameworks (FCA, PRA, DORA, NIS2), Middle East regulators (DFSA, VARA, ADGM, NCA Saudi Arabia), Channel Islands regulators (Guernsey FSC, Jersey FSC), Malta (MFSA, MGA) and Gibraltar (Gambling Commissioner, Gibraltar Financial Services Commission).
Talk to a Specialist
Start with a free cloud pen test, or scope a specialist engagement.
Tell us about your cloud environment and what you need to achieve. An Endida specialist responds within one business day with the right path — autonomous, specialist, or hybrid — and a clear next step.
✓
Free NodeZero trial — full results, no card required
✓
First cloud findings within hours of launch
✓
AWS, Azure and Kubernetes on a single platform
✓
CREST-certified specialist testers available on request
✓
SOC 2, ISO 27001, PCI DSS, FedRAMP-ready reporting
✓
Production-safe — runs alongside live cloud workloads
Request a cloud pen test
An Endida specialist will be in touch within one business day.
By submitting you agree to our Privacy Policy. We will never share your data with third parties.
Or book directly
Schedule a scoping call →
Request received
An Endida specialist will be in touch within one business day to scope your cloud pen test and recommend the right path.
While you wait, explore the NodeZero platform.
While you wait, explore the NodeZero platform.