The best cloud penetration testing companies in 2026 are Rhino Security Labs, NetSPI and Bishop Fox. Rhino runs separate, authenticated test services for AWS, Azure and GCP. NetSPI pairs point-in-time cloud pentests with a continuous option that watches for new misconfigurations. Bishop Fox builds each cloud test around objectives you set, such as reaching customer data from a compromised application.
This list is for buyers choosing a vendor to test AWS, Azure, Google Cloud, Kubernetes and Microsoft 365 environments. It covers service firms only, not automated platforms, and every company here sells a named cloud testing or cloud configuration review service. If you would rather build the skills in house, see our guide to the top cloud penetration testing certifications. For a broader view of UK security firms, our list of the top cyber security companies in Manchester is a useful companion.
We checked each company’s own website for its cloud testing scope, platforms covered, method and headquarters in October 2026.
Cloud Penetration Testing Companies At A Glance
Company
Headquarters
Best For
Cloud Testing Services
Rhino Security Labs
Seattle, US
Deep, provider-specific testing
AWS, Azure and GCP penetration tests
NetSPI
Minneapolis, US
Enterprises wanting continuous coverage
AWS, Azure and GCP pentests, continuous cloud testing
Bishop Fox
Tempe, US
Objective-based attack simulation
Cloud penetration testing with configuration review
Rhino Security Labs is a Seattle penetration testing firm that names cloud pentesting across AWS, GCP and Azure as a core focus, and it sells a dedicated service page for each provider. Its AWS penetration testing is an informed, audit-style engagement: you give the team a secured account on the AWS management console and they work through it with manual, deep-dive testing.
The GCP scope shows how far the testing goes. Rhino checks privilege escalation for every IAM identity, attempts data exfiltration from VMs, storage and databases to see whether controls catch it, reviews Cloud Functions code and triggers, tests Kubernetes Engine configurations, and looks for pivots into other clouds or on-premises networks through shared VPCs, VPC peering and Interconnect. Its Azure service covers Azure itself plus Intune, Dynamics 365 and Office 365, with reports that call out platform-specific issues and add strategic recommendations for leadership.
Best for: teams that want a specialist to test one or more providers in depth, with an attacker already inside.
2. NetSPI — AWS, Azure And GCP Pentests With A Continuous Option
NetSPI, headquartered in Minneapolis, tests AWS, Azure and Google Cloud from both anonymous and authenticated perspectives, with a stated focus on identity and access management policies and the misconfigurations that create high-risk exposure. Testing mixes manual work with commercial, open source and proprietary tools.
Coverage is described per provider. On AWS, NetSPI looks at insecure settings, misconfigured S3 buckets and issues that could lead to tenant-wide compromise. On GCP, it covers IAM policy implementation, Cloud Functions, GKE and Firebase applications, and it supports companies migrating to Google Cloud. On Azure, findings are linked to the specific affected resources. Results land in The NetSPI Platform, where you can collaborate with testers in real time and see validated, prioritized findings.
NetSPI also sells a continuous cloud service that flags misconfigurations, excessive permissions and exposed services as they appear, then simulates privilege escalation and lateral movement. Its testers hold certifications including OSCP, OSCE, GXPN and CREST.
Best for: enterprises with fast-changing cloud estates that want testing between annual pentests.
3. Bishop Fox — Objective-Based Cloud Tests Aimed At Trophy Targets
Bishop Fox is an offensive security firm headquartered in Tempe, Arizona, with offices in San Francisco, London and Barcelona. Its cloud penetration testing combines configuration review with hands-on exploitation, and its own pitch is to go beyond a configuration review. Its materials reference AWS, Microsoft Azure and Google Cloud, and the firm says it can work with any cloud environment.
You choose the scenario: a compromised application, a malicious user or a custom goal. Testers then hunt for unguarded entry points, overprivileged users and groups, and internal pathways for lateral movement, aiming for trophy targets such as customer data or privileged credentials. Reports show how assessors moved through the environment, score impact with a proprietary method that references OWASP and CVSS, and split findings into executive and technical breakdowns.
Best for: security leaders who want to prove what a real attacker could reach, not just a list of misconfigurations.
4. Praetorian — Three Tiers From Configuration Review To Attack Path Mapping
Austin-based Praetorian sells cloud testing at three depths, which makes scoping easier. A Cloud Security Configuration Review analyzes your cloud provider service settings without exploitation. A Cloud Penetration Test works toward objectives you define and demonstrates risk through exploitation. Cloud Attack Path Mapping combines both, adding interviews and threat modeling. Kubernetes cluster configuration analysis is an optional add-on in every tier.
The method runs in seven steps, from workshops and attack path enumeration through agreed test cases, execution with daily updates and immediate notice of critical findings, a written report and a technical briefing. Praetorian puts weight on what it calls access chaining, linking separate weaknesses into a route to privileged cloud access. Every tier ends with a PDF report and a technical and executive debrief, and engagements sit on its Praetorian Guard continuous offensive security platform.
Best for: buyers who want to start with a configuration review and step up to full attack path work later.
5. NCC Group — Configuration Assessments Across Five Cloud Providers
NCC Group was founded in 1999, is headquartered in Manchester and says it has over 1,800 experts across the UK, Europe, North America and Asia Pacific. Its cloud work covers AWS, Azure, Google Cloud, Oracle and Alibaba, which is wider than most firms on this list.
Two services lead. Cloud Configuration Assessments review your tenancy with an in-house scanner built on cloud provider CIS benchmarks and the AWS Well-Architected Framework, followed by manual validation through read-only console access. The Cloud Security Assurance Review goes broader, looking at governance, operations and technology, baselined to CSA, ISACA Cloud Audit and NIST CSF. A separate Container and Orchestration Review covers Docker and Kubernetes deployments, including privilege escalation risks.
Best for: large or multi-cloud organizations that need configuration and governance assurance alongside testing.
6. SEC Consult — Over 100 Cloud Pentests A Year Plus Dedicated Kubernetes Tests
SEC Consult is a European security consultancy, part of Atos, with offices in Vienna, Linz and Wiener Neustadt in Austria and Berlin, Munich, Bochum and Fürth in Germany. It says its testers run over 100 cloud penetration tests each year across Azure, AWS and GCP.
Tests cover both the control plane and the data plane. Assumed-breach engagements start from low-privileged accounts such as reader roles, regular users or service accounts, then chain privilege escalation and lateral movement. Typical findings include insecure identity and access management, secrets exposed in deployments or environment variables, publicly reachable storage accounts, outdated software on VMs and insecure handling of source code in serverless functions. SEC Consult also offers dedicated Kubernetes penetration tests and Docker analyses, and advises folding Kubernetes into the cloud test when a cluster could be used to escalate cloud permissions.
Best for: European buyers running containers who want one team to test the cluster and the cloud around it.
7. TrustedSec — Assumed Access Cloud Tests And A Microsoft Cloud Assessment
TrustedSec, based in Fairlawn, Ohio, runs cloud penetration tests against Azure and AWS using an Assumed Access Model. The test shows what an attacker could reach after compromising user credentials, an application or the underlying stack, with the aim of finding real attack paths in your cloud environment and checking whether your defenses work as intended.
For Microsoft-heavy companies, TrustedSec also sells a Microsoft Cloud Security Assessment covering Microsoft 365, Entra ID, Azure subscriptions, Exchange Online and SharePoint. It reviews authentication methods, Conditional Access, MFA enforcement and admin role assignments, then tests how identity or configuration weaknesses could allow lateral movement. Findings are mapped to Microsoft Secure Score and CIS benchmarks and close with a leadership briefing.
Best for: companies whose biggest cloud risk sits in Microsoft 365 and Entra ID rather than in IaaS.
UK testing firms Bulletproof and Pentest People now operate under the WorkNest Secure brand, launched by WorkNest in May 2026, and the old Bulletproof cloud testing page redirects here. The Cloud and Container Penetration Testing service is described as CHECK and CREST certified, which matters for UK public sector and regulated buyers.
The service has three parts. Cloud Assessments look for vulnerabilities and misconfigurations in AWS, Azure or Google Cloud, including weak access controls on storage buckets and IaaS, PaaS and SaaS deployments. Productivity Suite Reviews assess Microsoft 365 or Google Workspace. Container Security Reviews examine containers, runtimes and orchestration, including Docker and Kubernetes. Findings are ranked from low to critical in the GuardNest platform, which also runs continuous external infrastructure scanning between tests.
Best for: UK organizations that want cloud, container and Microsoft 365 testing from one accredited supplier.
9. Cobalt — Cloud Pentests That Can Start Within 24 Hours
Cobalt is a pentest as a service (PTaaS) provider with its US headquarters in Boston and a UK office in Oxford. Tests are delivered by its vetted pentester community, Cobalt Core, and booked through its platform on a credit model, with testing that can start in 24 hours.
The cloud pentest covers AWS, Azure and GCP, including hybrid and multi-cloud setups. It targets IAM, storage, networking and compute aligned to the OWASP Cloud-Native Top 10, plus attack paths built from chained, manual exploits. Cobalt also runs cloud configuration pentests against CIS benchmarks, with provider-specific checks: on AWS, services such as CloudTrail, EC2, IAM, RDS and S3; on Azure, areas such as Microsoft Defender, Key Vault and App Service; on GCP, Cloud SQL and BigQuery among others. Testers need read-only access, such as the SecurityAudit and ViewOnlyAccess policies on AWS.
Best for: SaaS teams that need a cloud test scheduled quickly, often ahead of an audit or customer review.
10. Securitum — Six-Area Cloud Assessment Aligned To CSA And OWASP
Securitum is a Krakow penetration testing company founded in 2009, with a team of more than 50 people. It describes itself as one of the biggest penetration testing companies in Central and Eastern Europe and says it runs almost 750 security tests a year for more than 300 clients.
Its cloud security and cloud assessment service follows Cloud Security Alliance guidance and the OWASP Cloud Security Testing Guide. The scope is split into six areas: IAM (privilege matrix, least privilege, overprivileged accounts and default settings), network (firewall rules, security groups, subnet separation), storage (permissions, encryption, backups), monitoring and logging, databases, and virtual machines. Pricing depends on the size and complexity of the environment and is quoted by the sales team.
Best for: European companies that want a structured cloud configuration review from an established regional tester.
How To Choose A Cloud Penetration Testing Company
Do You Need A Pentest Or A Cloud Configuration Review?
A cloud configuration review checks your settings against benchmarks such as CIS and the provider’s own guidance, usually with read-only access and no exploitation. A cloud penetration test goes further and proves impact by chaining weaknesses into a path to sensitive data or admin rights. If you have never been assessed, a configuration review is a sensible first step. If you already fix benchmark findings, an objective-based test will tell you more.
Does The Firm Cover Your Specific Providers And Services?
Ask for provider-specific scope, not a generic cloud promise. AWS penetration testing should name IAM, S3, Lambda and cross-account roles. Azure work should cover Entra ID and subscriptions. GCP scope should include IAM, GKE and Cloud Functions. If Microsoft 365 or Google Workspace holds your most sensitive data, make sure the productivity suite is in scope. Teams that want to grow internal skills for these platforms can start with our Azure and Microsoft 365 security training courses.
Should Kubernetes Be Tested Separately?
If you run EKS, AKS or GKE, a compromised pod can often lead to cloud credentials, so the cluster and the cloud account should be tested together or at least by the same team. SEC Consult, Praetorian, NCC Group and WorkNest Secure all list Kubernetes or container review work. For background on what testers look for, see our list of Kubernetes security training providers.
What Accreditations And Reporting Should You Expect?
UK public sector buyers often need CHECK, and many regulated buyers ask for CREST. Beyond badges, ask for a sample report. Good reports show the attack path step by step, rate exploit likelihood and impact, separate executive and technical findings, and include retesting. Also ask whether findings are delivered through a platform and whether continuous testing is available between engagements.
Frequently Asked Questions
What Is Cloud Penetration Testing?
Cloud penetration testing is an authorized attack simulation against your AWS, Azure, Google Cloud or SaaS environment. Testers look for weak IAM policies, exposed storage, leaked secrets and misconfigured services, then try to chain them into privilege escalation or data access. It covers the parts of the cloud you control under the shared responsibility model, not the provider’s own infrastructure.
Do You Need Permission From AWS, Azure Or Google To Run A Pentest?
Generally no for common services, as long as you follow each provider’s policy. Rhino Security Labs notes that Azure has not required pre-approval since June 2017, and GCP testing must follow Google’s acceptable use policy. All three providers forbid denial-of-service testing and testing resources you do not own. Your vendor should confirm the current rules during scoping.
How Often Should You Run A Cloud Pentest?
Most companies test at least once a year and after major changes, such as a migration, a new account structure or a new product launch. Because cloud settings change daily, many buyers add continuous testing or scanning between engagements. NetSPI, Praetorian and WorkNest Secure each describe continuous options alongside their scheduled cloud penetration testing.
Conclusion
Our list of the top cloud penetration testing companies in 2026 starts with Rhino Security Labs for depth on each provider, NetSPI for continuous coverage and Bishop Fox for objective-based attack simulation. Praetorian suits buyers who want to choose their engagement depth, NCC Group and SEC Consult bring large multi-cloud and European teams, and TrustedSec stands out for Microsoft 365 and Entra ID. WorkNest Secure, Cobalt and Securitum round out the list for UK accreditation, fast PTaaS scheduling and Central European coverage.
Whichever cloud penetration testing companies you shortlist, ask each for provider-specific scope, a sample report and clear retest terms before you sign.
