Assessment domain
Network exposure
Network exposure is about reachability: what an attacker can touch from the public internet, and where they can go once they have a single foothold inside. Cloud networks drift open one convenience rule at a time — a temporary port left in place, a public IP nobody meant to keep, a security group that trusts everything. We map the paths in, the paths sideways, and the paths out, because the shortest route to your data is usually a door that was never meant to stay open.
Why it matters
Where the risk lives
In the cloud, network controls are the difference between a contained incident and a full compromise. An exposed management port turns a phished credential or a weak password into direct administrative access, and a flat network turns one compromised workload into reach across the whole estate. Egress paths matter just as much on the way out — unrestricted outbound is how stolen data and command-and-control traffic leave unnoticed. Network findings map cleanly to PCI-DSS segmentation requirements, CIS networking benchmarks, NIST CSF protective controls, and ISO 27001 network security controls, so tightening exposure produces audit evidence at the same time.
What we assess
The checks inside network exposure
Each area below is a focused review with its own findings, per-cloud detail, and remediation.
Security groups & firewall rules
Security groups and firewall rules are the primary gatekeepers of cloud traffic, and they drift toward permissive over time as teams open ranges to unblock work and forget to close them. Broad source ranges, whole-port openings, and rules that reference other broad groups quietly widen what is reachable. We review every ingress and egress rule for how far it opens and whether that width is justified by an actual workload.
What we look forExposed management ports (SSH/RDP)
Management ports such as SSH (22) and RDP (3389) exposed to the internet are among the most reliably exploited cloud findings, because they offer direct administrative access and are constantly scanned and brute-forced. The safe pattern is to reach admin surfaces through a bastion, a managed connection service, or just-in-time access rather than a standing public rule. We identify every host and service where these ports are reachable from outside a trusted boundary.
What we look forPublic endpoints & load balancers
Load balancers, API gateways, and public IPs are meant to publish some services — but they routinely publish more than intended, exposing internal APIs, staging environments, and management interfaces to anyone. We inventory what is actually reachable at the edge and compare it to what should be public. The goal is a small, deliberate public surface, with everything else behind private networking.
What we look forSegmentation & lateral movement
Segmentation determines how far an attacker can travel after the first compromise. Flat networks — where every workload can reach every other — mean one foothold is effectively a foothold everywhere, and production, dev, and management planes often share a trust boundary that should not exist. We look at how the network is partitioned between environments and tiers, and how much lateral reach a single compromised workload would actually have.
What we look forEgress & exfiltration paths
Outbound traffic gets far less attention than inbound, yet it is the path stolen data and command-and-control channels use to leave. Most cloud environments allow unrestricted egress by default, so a compromised workload can reach any destination on the internet without triggering a control. We assess whether outbound is constrained to known destinations and whether cloud provider services are reached over private paths rather than the public internet.
What we look forAcross your clouds
AWS, Azure & Google Cloud
AWS
Security groups and network ACLs; public vs. private subnets and route tables; internet and NAT gateways; ALB/NLB and public IP exposure; VPC peering and Transit Gateway reach; VPC endpoints for private service access; Systems Manager Session Manager as a bastion alternative.
Azure
Network security groups (NSGs) and application security groups; public IPs and Azure Firewall; Azure Bastion vs. directly exposed RDP/SSH; VNet peering and hub-spoke topology; Private Link and service endpoints; Load Balancer and Application Gateway/WAF exposure.
Google Cloud
VPC firewall rules and hierarchical firewall policies; external IPs and Cloud NAT; Identity-Aware Proxy (IAP) vs. exposed SSH/RDP; VPC peering and Shared VPC reach; Private Google Access and Private Service Connect; Cloud Load Balancing and Cloud Armor exposure.
Compliance evidence
Frameworks this domain produces evidence for
Example finding
RDP open to 0.0.0.0/0 on a production host
Risk: Administrative access is directly brute-forceable from the entire internet — a standing invitation that automated scanners find within minutes and that turns one weak or reused password into host compromise.
Fix: Close the public rule and route administrative access through a bastion or managed access service (Session Manager, Azure Bastion, or IAP) with just-in-time, source-restricted connections.
Questions
Do you run scans or attacks against our network?
No. This is a read-only assessment — we review the network configuration (security groups, firewall rules, routes, and endpoints) as recorded in your cloud provider. There is no active exploitation, no penetration testing, and nothing is changed in production.
Is this the same as a penetration test?
No. A pen test probes from the outside for what it can break into; we read the configuration from the inside to map what is reachable and how far an attacker could move once in. The two are complementary — the health check shows you where the exposure is by design, without touching the running environment.
How does network exposure map to compliance?
Network findings map directly to PCI-DSS network segmentation and firewall requirements, CIS networking benchmarks, NIST CSF protective controls, and ISO 27001 network security controls — so closing an exposed port or tightening segmentation also produces evidence auditors and insurers ask for.
See where you stand on network exposure
A health check finds and prioritizes real exposure. It is not a certification or a promise you will never be breached — closing the findings is what changes your risk.
Related domains
The rest of the health check
One read-only assessment covers all six domains — here's where else exposure tends to hide.
