Secure the cloud and the network your business runs on.

It assesses and strengthens the security of cloud accounts on AWS, Azure and Google Cloud, private and hybrid cloud, servers, cloud VMs, Kubernetes and containers, virtualisation, databases, endpoints and EDR, firewalls, VPN and remote access, and identity. It ends with ranked findings, a remediation tracker and a phased zero trust roadmap.

VAPT tests applications, APIs and networks for exploitable vulnerabilities. This service looks at how cloud and infrastructure platforms are configured, who can do what, how zones are separated and how mature the organisation is against zero trust principles. The two complement each other, and Codec Networks offers VAPT as a separate service.

A posture tool lists settings that may be risky, often thousands of them, with no view of what is reachable or what matters most. A Codec Networks review validates which exposures are real, follows identities and paths across accounts, adds infrastructure and endpoints, and turns the result into a ranked plan and a roadmap.

Only part of it. Providers secure their data centres, hardware and core services. The customer stays responsible for identities and permissions, network rules, storage settings, encryption choices, patching of its workloads, logging and access. Most serious cloud incidents start on the customer's side of that line.

It means no user, device or workload is trusted just because it is inside the network. Every access request is verified explicitly, privileges are kept to the minimum, the network is segmented, and activity is monitored continuously. It is an operating model built over time, not a single product.

Those controls are only as good as their configuration and coverage. The review shows where an identity has more rights than it should, where a rule undoes a firewall, which servers have no EDR agent, and whether the SOC would see an attacker using valid credentials.

At least yearly for every production environment, and whenever something significant changes: a migration, a new account or cluster, a new access model or a merger. Many organisations add monthly or quarterly posture reviews to catch drift between full assessments.

No assessment can guarantee that. It reduces risk by finding and closing the weaknesses an attacker would most likely use, and gives you evidence of how well your controls hold up at a point in time.

Cloud accounts, subscriptions and projects; internet-facing cloud assets; cloud VMs; Kubernetes and container platforms; servers; endpoints and EDR; VPN and ZTNA; firewalls and security devices; cloud databases; network segmentation; Active Directory and cloud identity; configuration and patch status; and zero trust maturity. Document 2 describes all fifteen services.

Start with what holds sensitive data or money, what is internet-facing, what recently changed and who can administer it. The scoping call ranks accounts and assets by exposure and business criticality, then matches them to the right services.

Yes. AWS, Azure and Google Cloud are reviewed against the same baseline and rated on the same scale, together with private cloud and data centre infrastructure, so the Board sees one risk picture.

For most configuration review, a time-bound, read-only role in each in-scope account or subscription. Where policy rules out direct access, we work from evidence exports. Active technical validation needs separate written authorisation and agreed testing windows.

A list of in-scope accounts, workloads, servers, clusters and devices; architecture and network diagrams; the identity and privileged access model; available patch, EDR and scan reports; testing windows and exclusions; escalation contacts; and the frameworks you report against.

Yes, with the customer's authorisation and, where their contract requires it, the partner's agreement. The partner usually provides inputs, access or evidence, and its findings are reported to the customer as owner of the risk.

It depends on the number of accounts, regions, workloads, devices and clusters, and on how quickly access and evidence are ready. A single cloud account takes far less time than a multi-cloud regulated estate. The schedule is agreed in the proposal before work starts.

Cloud Essential suits one account or a first baseline; Cloud Professional covers several accounts with a tracker and retest support; Cloud Enterprise covers multi-cloud or regulated estates with a zero trust roadmap; Continuous Cloud Assurance gives monthly or quarterly posture review. Pricing is based on scope.

The aim is zero disruption. Configuration review is read-only and cannot change anything. Active validation, where authorised, follows rules of engagement that set the permitted methods, production limits, stop conditions and testing windows, and is performed without destructive impact.

Read-only review examines settings, permissions, rules and logs. Active validation tests what is actually reachable or exploitable, such as an exposed service, a segmentation path or a privilege escalation. Most engagements combine broad read-only review with targeted validation of the most serious findings.

CIS Benchmarks and CIS Controls, cloud provider security guidance, NIST CSF 2.0, NIST SP 800-207 Zero Trust Architecture, the CISA Zero Trust Maturity Model, ISO/IEC 27001, 27017 and 27018, Kubernetes hardening guidance and MITRE ATT&CK, with CVSS for technical severity where it applies.

Both. Tools give coverage across thousands of settings; consultants find the combinations that matter, follow identities across accounts, and validate critical and high findings by hand wherever technically feasible before they are reported.

It goes straight to the agreed escalation contact through the route set in the rules of engagement, so containment can start at once rather than waiting for the report. Codec Networks does not make the change itself unless separately contracted.

Codec Networks is certified to ISO/IEC 27001:2022. Access is time-bound and least-privilege, credentials and evidence are handled on a need-to-know basis and shared securely, and customer data is used only for the engagement.

Major cloud providers allow customers to assess their own resources within published policies, some of which exclude activities such as denial-of-service testing. Codec Networks follows those policies and confirms any provider-specific conditions during scoping.

Yes, and it is useful. Some clients tell the SOC in advance; others keep validation activity quiet to see what is detected. Either way, the results show which activity your monitoring caught and where cloud logging or alerting has gaps.

A cloud risk posture report, misconfiguration and IAM findings, a network segmentation review, a zero trust roadmap, compliance mapping, a remediation tracker and a management presentation, plus container, server and endpoint findings where those are in scope, and a retest or closure report where included.

On a five-level scale from Critical to Informational. Each rating starts from technical severity and is adjusted for exploitability, asset criticality and exposure, business impact and compensating controls, so that the order of fixes reflects real risk.

A phased plan that scores current maturity across eight pillars, agrees a target for each, and sequences the work, typically identity and privileged access first, then devices and segmentation, then data, visibility and automation, with owners and milestones.

Yes. Clarification sessions walk your teams through each finding and the recommended fix. Remediation itself, such as configuration changes or managed cloud operations, stays with your teams or can be contracted separately.

A focused second round that checks whether each fixed finding is really closed, marking it fixed, partly fixed or still open. Retest support is part of Cloud Professional and Cloud Enterprise; for Cloud Essential, or for extra cycles, it is added to the scope.

The business owner can formally accept or defer the risk. A risk-acceptance note records the justification, compensating controls, residual risk and a review date, so the decision is visible to management and auditors.

Reports are confidential and for internal governance, remediation and audit support. Many clients share the executive summary or a closure letter with customers and auditors, with written agreement, and keep the full technical findings internal.

Use the same severity scale, accounts and pillars each cycle. The executive summary then shows trends: fewer critical findings, fewer excessive privileges, less public exposure, fewer overdue patches and a rising zero trust maturity score.

Yes. Codec Networks is empanelled by CERT-In for information security auditing services, and with NICSI for application audit and compliance services in the start-up category. Eligibility is confirmed in every proposal where required.

It provides technical evidence that supports compliance, including cloud and outsourcing expectations, but compliance depends on the full set of requirements for your entity. Regulatory references in this set are general guidance; confirm obligations against the official instruments.

PCI DSS v4.0.1 calls for network security controls, secure configuration and regular segmentation testing. The firewall, segmentation, configuration and cloud reviews map directly to those requirements for cardholder data environments.

Yes. Findings and closure evidence support ISO/IEC 27001 controls such as information security for use of cloud services and configuration management, ISO/IEC 27017 cloud controls, and SOC 2 criteria on logical access, change management and monitoring.

The DPDP Act 2023 and Rules 2025 require reasonable security safeguards, such as encryption, access control, logging, monitoring and backups. Reviewing the cloud and infrastructure that hold personal data is one of the clearest ways to show those safeguards work.

Yes. Findings can be mapped to ISO/IEC 27001, 27017 and 27018, NIST CSF 2.0, the CISA Zero Trust Maturity Model, CIS, SOC 2, PCI DSS, CERT-In guidance and RBI, SEBI or IRDAI expectations. The mapping is technical alignment, not a certification or legal opinion.

A retainer in which Codec Networks reviews your cloud posture every month or quarter, tracks remediation and configuration drift, maintains an executive dashboard and provides advisory support, so the gains from the first review are not lost.

Book a scoping call with Codec Networks. We agree the accounts, assets, objectives, access approach and engagement model, issue a proposal, sign the rules of engagement and start on the agreed date.