Short answer
A Helix cloud penetration test has two parts. Agents attack your internet-facing cloud services the way an outsider would, and they review your IAM and account configuration through a read-only role. Each misconfiguration is tied to the attack it enables. Prices start at $4,000 for a typical single account.
Need this for an audit?
Cloud testing is often in scope for SOC 2, PCI DSS, and ISO 27001 evidence and for customer security reviews. The report carries scope, methodology, reproduced findings, and retest results. See the SOC 2 pentest, PCI DSS guide, and ISO 27001 guide.
Internet-facing cloud services
The agents enumerate what your account exposes and test it from the outside:
- Load balancers, API gateways, and serverless functions, with the same depth as an API pentest where they are in scope.
- Storage buckets and blobs that can be listed or read without credentials.
- Virtual machines and managed databases with management ports or admin interfaces open to the internet.
- Server-side request forgery against instance metadata services, a common route from a web bug to cloud credentials.
IAM and configuration review
With a read-only role, the agents read how the account is built and look for what an attacker with one credential could do next.
| Area | What is checked |
|---|---|
| Identity and access | Over-broad roles and policies, wildcard permissions, paths to administrator, and unused keys |
| Trust relationships | Cross-account roles, federated identity, and CI/CD roles that anyone can assume |
| Storage | Public access, encryption, and bucket policies |
| Network | Security groups and firewall rules, exposed management ports, and paths between environments |
| Secrets | Credentials in environment variables, instance user data, and build logs |
| Logging | Whether audit logs are on and would record the attacks found |
For white box, add your Terraform or other infrastructure code and the agents check that the deployed account matches it. Code is uploaded in the portal and pinned by SHA-256 to the signed scope.
From misconfiguration to attack path
A list of settings is not a pentest. Each finding in the report states the starting point (the internet, a leaked key, a compromised function), the steps an attacker takes, and where they end up, such as reading a customer database or becoming an administrator. Findings are rated by that end point. A second agent then has to reproduce the path. If it cannot, the finding stays out of your report.
What's in the report
- Methodology and the signed rules of engagement, so an auditor or customer can see how the test was run.
- Scope: every account, project, and service tested, and the role the review used.
- Findings rated by what an attacker reaches, each with the evidence captured for it and a fix.
- The reproduction result for each finding from the second agent.
- Retest results for every fix, free and unlimited.
Findings also arrive in the portal as tickets your engineers can work from. Technical, executive, and compliance-mapped versions of the report are available, with an attestation letter.
What to provide
- The accounts, projects, or subscriptions in scope, and the domains and public addresses they serve. Each asset is checked for ownership before testing.
- A read-only role or service account for the configuration review. We send the exact policy to attach.
- For testing applications that run in the account, test accounts for each role.
- For white box, your infrastructure code.
Cloud provider rules
For your own resources, AWS, Google Cloud, and Azure generally do not require prior approval, within published policies that prohibit denial of service and attacks on the provider's own infrastructure. Check your provider's current policy; we follow it on every test. Helix tests only the resources in your signed scope, is detect-only by default, and never runs load or flooding tests. Agents run on private inference, so your account data is not sent to a third-party model provider.
Pricing and retesting
| Test | Price | Fits |
|---|---|---|
| Cloud (gray box) | From $4,000 USD | One account: exposed services plus read-only IAM review |
| Cloud white box | From $7,000 USD | Adds infrastructure code and drift checks |
More accounts, projects, or regions are priced before testing starts. Retesting is free and unlimited. For servers and networks outside the cloud, see network penetration testing.
Frequently asked questions
How much does a cloud penetration test cost?
A Helix cloud penetration test starts at $4,000 USD for a typical single account with its internet-facing services. Adding infrastructure code such as Terraform makes it white box, from $7,000 USD. The final price depends on the number of accounts, projects, and services and is confirmed before testing starts. Retesting is free and unlimited.
Do you need write access to our cloud account?
No. The configuration review uses a read-only role or service account that you create and can revoke at any time. Credentials are stored sealed and every access is audited. Nothing in the account is changed.
Which cloud providers do you test?
AWS, Google Cloud, and Microsoft Azure. Internet-facing testing works the same on any provider. The configuration review covers each provider's identity, storage, network, and secrets services.
Do we need permission from AWS, Google, or Microsoft?
Usually not for your own resources. AWS, Google Cloud, and Azure let customers test their own resources without prior approval, within their published policies, which prohibit attacks such as denial of service. Check your provider's current policy, and we follow it on every test.
How is this different from a cloud security posture scanner?
A posture scanner lists every setting that differs from a benchmark, often hundreds. A cloud pentest asks which of those settings an attacker could use, proves the path from the outside or from a stolen credential, and ranks findings by what they expose. You get fewer findings, each with evidence and a fix.