---
title: "Infrastructure / cloud"
url: "https://unshade.pl/en/services/infrastructure-and-cloud"
lang: "en"
summary: "AWS, Azure, GCP, Microsoft 365 and on-premise — from review to hardening."
---

# Infrastructure / cloud

Misconfiguration is the most common way into the cloud. We hunt for it in your accounts, clusters and pipelines — and help you close it for good.

## Scope

- Cloud security review and IAM testing
- Microsoft 365 and Entra ID
- Kubernetes and container security
- IaC and CI/CD pipeline review
- Server, network and AD hardening

## What you get

- Prioritised list of misconfigurations
- Ready-to-apply fixes (IaC / policies)
- Architecture recommendations
- Optional: implementation support

## IT infrastructure penetration testing

Controlled simulations of cyberattacks that reveal security gaps in networks, systems and devices — so they can be eliminated before real attackers exploit them. The whole process runs under control, keeping production systems running without interruption.

- **Black box** — with no prior knowledge of the infrastructure, based only on publicly available information: the way an external attacker would.
- **Grey box** — with partial knowledge, e.g. access to selected data or technical documentation: the scenario of an employee with limited privileges.
- **White box** — with full visibility into the architecture, configurations and code: the deepest analysis, including the most complex vulnerabilities.

## Cloud: Microsoft 365 and Azure

Many companies do not realise how many cloud services they use every day. It is not just on-demand servers and serverless applications, but also Microsoft Teams, Outlook and SharePoint — often overlooked by administrators, yet a target for attacks and an entry point for cybercriminals. Cloud environment tests uncover misconfigurations, excessive permissions and security gaps.

- **Verified cloud protection** — whether your M365 and Azure environment is properly secured against attacks.
- **Misconfigurations** — settings that expose the organisation to risk.
- **MFA and access policies** — whether login and access control mechanisms work as intended.
- **Accounts and permissions** — users have only the privileges they need, and accounts are not open to takeover.
- **“Slow” tests** — slow, targeted attacks that test monitoring (e.g. Microsoft Sentinel), alerting and the SOC team's response.

## From review to hardening

We start with an inventory and a permissions review, check the configuration against CIS Benchmarks and the vendor's good practice, and finish with ready fixes your team can roll out from the repository. The report includes CVSS risk ratings and references to the OWASP Cloud-Native Top 10.

## What our clients say

> Working with Unshade guarantees professionalism and the highest standards. The team's flexibility, discretion and commitment were outstanding. I highly recommend Unshade as a reliable partner.
> — Marcin Marczewski, CEO, Resilia

> Unshade is a reliable and professional partner that conducted penetration tests and IT security workshops for us at the highest level. The team's expert knowledge and meticulousness resulted in a real strengthening of our systems' security. We fully recommend their services.
> — Piotr Goździejewski, Head of DevSecOps, e-file

> The Unshade team are true professionals in their field. Thanks to their knowledge and commitment, we were able to significantly improve the security of our applications. We recommend their services to anyone who values quality and reliability.
> — Donata Basińska, Vice President, WebTailor

## Blog

- [120 minutes that can save your company – a cybersecurity awareness training](https://unshade.pl/en/blog/120-minutes-that-can-save-your-company.md)
- [PBKDF i bcrypt](https://unshade.pl/en/blog/pbkdf-and-bcrypt.md)
- [How to Bypass AMSI? My Experience with PowerShell Bypassing](https://unshade.pl/en/blog/how-to-bypass-amsi.md)
- [Bcrypt Cocktail and Hash Extraction](https://unshade.pl/en/blog/bcrypt-cocktail-and-hash-extraction.md)
- [Sacrificial session](https://unshade.pl/en/blog/sacrificial-session.md)
- [Hash function](https://unshade.pl/en/blog/hash-function.md)
- [Introduction to Password Cracking #3 Rules](https://unshade.pl/en/blog/introduction-to-password-cracking-3-rules.md)
- [Introduction to Password Cracking #1 Intro](https://unshade.pl/en/blog/introduction-to-password-cracking-1-intro.md)
- [Introduction to Password Cracking #2 Wordlists](https://unshade.pl/en/blog/introduction-to-password-cracking-2-wordlists.md)
- [CrackMeIFYouCan 2022 DEFCON Writeup](https://unshade.pl/en/blog/crackmeifyoucan-2022-defcon-writeup.md)

## Request an anonymised report

See what our penetration test report looks like: the structure, findings with PoC, CVSS ratings and recommendations. We send an anonymised version to your work email.