Your infrastructure lives in other people's services. The risk is still yours.
We review the access, cloud services, roles, accounts and processes that remain under your company's control.
Who has access to your data and work accounts
A former employee may still open shared files. A contractor may have admin rights. We check where that is possible in your services.
An assessment fits if
- You work on ready-made services: Google Workspace, Microsoft 365, Shopify, a cloud CRM
- You have no servers of your own, or very few
- The main risk is access, accounts and processes, not code
- Nobody is separately responsible for security
Better to start with a pentest if
- You have your own web application or API
- You have infrastructure that you control yourself
- You need to test business logic and access rights inside the product
- A client or partner requires independent testing of the product
What exactly we evaluate
The three areas where most incidents happen in companies without their own infrastructure.
Who has access to what
- Accounts and their current state
- Administrative roles
- Multi-factor authentication
- Access rights to data
- Shared accounts and passwords
How the things you use are configured
- Google Workspace / Microsoft 365 configuration
- Mail rules and forwarding
- External access to files and documents
- Third-party apps with access to your data
- Email protection against sender spoofing
What happens when something goes wrong
- Employee onboarding and offboarding
- Backups and whether they actually restore
- Incident response
- Who grants access, and how
- What gets logged and what leaves no trace anywhere
What we do not do
We do not test the infrastructure of Google, Microsoft or Shopify
It does not belong to you, and we have no right to test it. We evaluate what you do control: configuration, access, roles and processes inside your own accounts.
That is exactly where most real incidents originate: not in the platform itself, but in how it is configured and who has access to it. The extent of the review and the level of access are agreed in advance.
How the work runs
A short call
We work out which services you use, how many people are on the team and where problems have already come up.
Boundaries and access
We record what is included in the review and what level of access is needed. All of it with your written approval.
Testing
We look at configuration, access, roles and processes. Part of it together with you, over a screen share.
A prioritised report
What to change first, what to schedule, and what specifically needs to be clicked or rewritten.
Walkthrough and plan
We go through the results on a call and put together an order of actions. If needed, we verify again after the changes.
What you get
A prioritised list of problems
Not "everything is bad", but specific items in order of importance.
Specific settings
What exactly to change in accounts and services — at the level of actions, not general advice.
A description of the processes that are missing
What is worth writing down and fixing in place so the problem does not come back in a month.
A walkthrough on a call
We go through the results together and answer your team's questions.
A plan for the first and second wave
What we do now, and what can be planned for the next quarter.
Retest
After the changes we look again and record what has been closed.
Who it suits
Agencies and studios
Access to client accounts, many contractors, people changing quickly.
Small SaaS teams
The product is in the cloud, there is almost no infrastructure, and there is a lot of client data.
E-commerce on ready-made platforms
Shopify and similar: the risk is not in the server but in access to the admin panel.
Clinics and service businesses
Sensitive data, many employees, few formal processes.
Distributed teams
People in different countries, personal devices, dozens of services.
Companies without an AppSec function
There is no dedicated security person, and you need to understand the baseline state.
The founder leads every project and answers for the result
I lead the assessment and answer for the result: in this kind of review almost everything depends on asking the right questions, not on tools.
I lead a cybersecurity team. Since 2019 I have run 170+ penetration tests for 80+ companies. I have worked on the security of many Ukrainian banks and payment systems, as well as government bodies and law enforcement. The founder runs the project, and nothing is handed to outside contractors.
I test systems the same way a real attacker does — from the outside, with no hints, with no access from within.
Frequently asked questions
Other Veiltrack security services
If there is more than one area
The assessment looks at accounts, access and processes. Technical testing of systems is done by separate formats.
Vulnerability Assessment
When besides the cloud accounts there are servers and domains of your own reachable from the internet.
Veiltrack Security Program
When access, the application and the human factor need testing together, with a single prioritisation.
Book a 30-minute review call
30 minutes: we go through which services you use and what should be checked first.