cloudpentest
Check your scope

About cloudpentest.org

Updated

cloudpentest.org covers penetration testing and security assessment of AWS, Microsoft Azure and Google Cloud environments. Most of what it publishes is a restatement of provider policy, so provenance matters more here than on most sites, and it is set out below.

Publisher

The site is published by SEQ SIA (reg. No. 40203410806), Lastādijas iela 12 k-3, Riga, LV-1050, Latvia, trading as OffSeq, a provider of penetration testing and security assessment services. Contact: support@offseq.com.

cloudpentest.org is not affiliated with, endorsed by or connected to Amazon Web Services, Microsoft, Google, the Center for Internet Security, the Cloud Security Alliance, OWASP or the Kubernetes project. Their names appear here because their published material is what the site cites.

Authorship

SEQ SIA (OffSeq) is responsible for publishing, maintaining and updating this site. Articles use team attribution. Every guide lists its sources so a reader can check the basis for the guidance rather than take it on trust.

How the guidance is sourced

  • Provider rules are quoted from the provider’s own published policy page, and the page is linked. We do not paraphrase a rule from a blog post or a training course.
  • Regulatory statements cite the instrument itself on EUR-Lex, by article number, rather than a summary of it.
  • Where a provider’s position is silent rather than permissive, we say that it is silent. Amazon EKS is not on the AWS permitted-service list, and the site says so instead of assuming.
  • Engagement descriptions are generalised from real work and never identify a client, an account or an unremediated finding.
  • The “Updated” date only moves when the text changes; an automated content-hash ledger reverts unearned bumps.

What this site cannot tell you

Provider policies change, sometimes without an announcement. Nothing here is authorization to test anything, and it is not a substitute for reading the current policy page on the day you plan to test. Where this site and a provider disagree, the provider is right.

Commercial interest

We sell the kind of assessment this site describes. That is a direct interest in you concluding that you need one, and it should colour how you read every recommendation here.

  • Links to OffSeq are our own service links, not a market comparison. We do not rank or score competing providers.
  • No cloud provider, tool vendor or platform pays for a mention. There is no advertising and no affiliate revenue.
  • Where a question is answered by a configuration change rather than an engagement, we say so.

Not advice

This site is not legal advice on NIS2, DORA or any other obligation, and it is not a scoping opinion for your environment. Decisions about what falls in scope belong with your own counsel, your competent authority where one applies, and your cloud provider’s current terms.

Corrections

Send corrections to support@offseq.com, particularly where a provider policy has moved on. Substantive changes are made and re-dated in the open.