Skip to content
Edictum Labs, home
Discipline 04

Cloud &
infrastructure

Cloud accounts, Kubernetes platforms, and the pipelines that deploy them. We find the over-trusted identity, the isolation that only exists on paper, and the configuration that quietly undoes both.

Scope a cloud assessment
Scope
IAM · Kubernetes · IaC
Lens
Identity & isolation
Based in
Prague
The problem

One over-trusted identity is often the whole breach.

Configuration scanners report what is misconfigured. The question that decides impact is what an attacker can reach from there.

Cloud and container platforms concentrate authority in a small number of identities, policies, and pipelines. A single permissive role, a workload that can read its node’s credentials, or a pipeline that trusts the wrong input can turn an ordinary foothold into control of the environment.

We assess infrastructure the way an adversary experiences it: starting from a realistic position and proving how far it actually goes.

Scope

What we assess.

Engagements are scoped to your accounts, clusters, and deployment model — and to the questions you actually need answered.
  • Cloud IAM, roles, and privilege-escalation paths
  • Kubernetes clusters and container platforms
  • Workload, tenant, and account isolation
  • Infrastructure-as-code and configuration review
  • CI/CD pipelines and deployment trust
  • Network segmentation and service-to-service authorization
Approach

How we test infrastructure.

01

Identity is the perimeter

In cloud environments the decisive boundary is usually identity — roles, trust policies, workload credentials, and the chains that turn a narrow foothold into broad control. We map those paths and prove which ones are real.
02

Isolation is a claim to test

Accounts, namespaces, node pools, and networks are meant to keep workloads apart. We test whether they do from inside a compromised workload, not from an architecture diagram.
03

Configuration is code

Infrastructure-as-code, admission policy, and deployment pipelines decide what production becomes. We review them as the attack surface they are, and trace each finding to the line that causes it.
04

Managed does not mean finished

Managed services move the boundary rather than remove it. We assess the seams between your workloads and the services they trust — metadata endpoints, service accounts, and cross-account access.
What you receive

Paths, not just a list of settings.

Findings arrive as demonstrated paths with the configuration that enables them, so the fix is obvious and verifiable.
  • Privilege paths shown end to end, with evidence
  • Isolation findings demonstrated from a realistic foothold
  • Configuration findings traced to the code that causes them
  • Remediation prioritised for your deployment model
  • Guidance that closes the class, not one misconfiguration
  • Retest of fixes against the original and variant paths
Rules of engagement

Your resources, your authorization.

We test only resources you own and authorize, within your cloud provider's published testing policies.

Every engagement runs under a signed scope that names the accounts, clusters, and environments involved. We avoid disruption to production, handle any data we encounter with care, and report critical exposure immediately rather than waiting for the final document.

Cloud & infrastructure

Not sure what your cloud identities can really reach?

Tell us how your environment is laid out — accounts, clusters, pipelines — and we will scope an assessment that proves where the boundaries actually are.

Reply
Within two business days
Authorization
Written, before any testing
Based in
Prague, Czech Republic