CREST-Certified GCP Cloud Security Review and GCP Penetration Testing
GCP penetration testing aligned to the CIS Google Cloud Platform Foundations Benchmark. Manual exploitation across IAM, Cloud Storage, GKE, Cloud Functions, Cloud Run, Cloud SQL, Secret Manager, and VPC. Multi-project organisations supported.
GCP scanners flag misconfigurations. We exploit them.
Security Command Center flags overly permissive Cloud Storage buckets and excessive IAM roles. It cannot tell you whether your Cloud Function’s service account can impersonate every other service account in your project, whether your GKE pod can hijack the workload identity, or whether your Cloud Run service has standing access to production secrets.
Our GCP cloud security review combines automated CIS Google Cloud Platform Foundations scanning with manual exploitation across IAM, GKE, Cloud Functions, and the Resource Manager control plane. Reports satisfy ISO 27001 Annex A.13.1, SOC 2 CC6.6, PCI DSS Req 11.3, and align with NCSC cloud security principles. We support UK CHECK alignment for public-sector tenants.
12 GCP SERVICES AUDITED
What We Test in GCP Cloud Security Review
Aligned to the CIS Google Cloud Platform Foundations Benchmark v3.0. Multi-project organisations supported via Cloud Resource Manager.
Identity & Access
Service-account impersonation chains, IAM Conditions audit, role recommender review, custom role analysis, group-based access boundary.
Object Storage
Public bucket audit, IAM vs ACL precedence, signed URL leakage, Object Versioning policy, Bucket Lock review.
Kubernetes Engine
Workload Identity boundary, RBAC, Network Policies, GKE Autopilot vs Standard, Binary Authorization, image security.
Serverless
Function service account scope, runtime environment leakage, IAM allow-internal, source code privacy, Pub/Sub trigger auth.
Containerised Apps
Service-account binding, ingress restriction, VPC connector, custom domain TLS, traffic split security.
Managed Databases
Public IP exposure, encryption at rest, automatic backups, IAM database authentication, snapshot privacy.
Secret Manager
Access policy review, rotation enforcement, replication policy, version history retention, Cloud Build secret leakage.
Networking
Default network audit, firewall rule review, Shared VPC, VPC Service Controls, Private Service Connect, BGP routing.
Encryption Keys
Key ring access, automatic rotation, version state management, key policy review, Cloud HSM scope.
Audit Logs
Cloud Audit Logs coverage, sink configuration, log integrity, retention policies, BigQuery export security.
CI/CD Pipeline
Build trigger security, service account scope, Artifact Registry security, supply chain integrity (SLSA).
Resource Manager
Organization policy enforcement, project IAM inheritance, billing account boundaries, folder structure scrutiny.
FOUR-PHASE METHODOLOGY
GCP Cloud Security Review — From Project Inventory to Hardening Plan
Read-only by default. Manual exploitation only with explicit written approval per resource type.
Project Discovery
CIS Benchmark Audit
Manual Exploitation
Report & Hardening
Verified Accreditations Auditors Accept
Every accreditation independently issued by a recognised UK certification body. Click CREST to verify our membership.
COMPLIANCE READY
GCP Reports Mapped to Every Framework
Findings tagged to CIS Benchmark control IDs and your specific compliance framework. Audit teams submit directly without translation.
CIS GCP Foundations v3.0
Control-by-control compliance score and remediation evidence accepted by enterprise audit teams.
UK CHECK
GCP-specific UK CHECK alignment for public-sector tenants and government suppliers.
ISO 27001 (Annex A)
A.13 network security, A.14 secure development, A.18 compliance — GCP-control evidence ISO auditors accept.
SOC 2 Type I & II
CC6.6 logical access, CC7.1 vulnerability identification, CC7.2 monitoring evidence accepted by SOC 2 auditors.
PCI DSS
Req 1, 2, 7, 8, 11.3 control evidence for GCP-hosted PCI scope, including segmentation and encryption attestation.
NCSC Cloud Security Principles
14 principles assessed for cloud workloads in GCP tenants.
TRANSPARENT PRICING
Transparent GCP Cloud Security Review Pricing
All tiers include the same depth of testing. Price varies by GCP estate complexity — project count, service breadth, resource volume, and Organization scope.
Depends on GCP estate size
Single project, ≤10 services in use, ≤50 resources, basic IAM. Typically 4-5 day engagement.
- ✓Free retests included
- ✓Free rescheduling
- ✓No cancellation fees
- ✓24-hour scope to active testing
- ✓Live findings to client portal
- ✓Executive + technical report
- ✓60-min walkthrough call
- ✓Letter of attestation
Depends on GCP estate size
Cloud Resource Manager folder (3-10 projects), 10-20 services, GKE or Cloud Functions, CI/CD via Cloud Build. Typically 7-10 day engagement.
- ✓Free retests included
- ✓Free rescheduling
- ✓No cancellation fees
- ✓24-hour scope to active testing
- ✓Live findings to client portal
- ✓Executive + technical report
- ✓60-min walkthrough call
- ✓Letter of attestation
Depends on GCP estate size
GCP Organization (10+ projects), 20+ services, multi-region, GKE Autopilot + VPC Service Controls + data perimeter. Typically 10-15 day engagement.
- ✓Free retests included
- ✓Free rescheduling
- ✓No cancellation fees
- ✓24-hour scope to active testing
- ✓Live findings to client portal
- ✓Executive + technical report
- ✓60-min walkthrough call
- ✓Letter of attestation
GCP Cloud Security Review for Your Sector
GCP deployment patterns vary by sector. We test the controls your regulators specifically require.
Fintech
FCA-regulated firms, Open Banking, payment APIs, PCI scoping.
SaaS
Multi-tenant isolation, SSO/SAML/OIDC, customer-data perimeter, SOC 2 evidence.
Healthcare
NHS DSPT, NHS DTAC, EHR integration, telehealth, patient-data PII.
Insurance
FCA / PRA Operational Resilience, claims data, broker integrations, cyber underwriting evidence.
Law
Privileged-data confidentiality, partner-tier scrutiny, SRA Cyber Standard alignment.
Public Sector
CCS / G-Cloud framework, NCSC-aligned, SC-cleared testers available.
What You Actually Get
Five things that distinguish our service from automated scans and box-tick competitors.
What You Get From GCP Penetration Testing
CIS Benchmark + Manual Combination
Read-Only by Default
Terraform / Deployment Manager Patches
UK CREST + UK CHECK Aligned
Frequently Asked
How long does a GCP cloud security review take?
Single-project (≤10 services, ≤50 resources) typically takes 4-5 working days. Folder-level multi-project takes 7-10 days. Organization-level enterprise (10+ projects, multi-region GKE) takes 10-15 days.
How much does GCP penetration testing cost in the UK?
Single-project £6,000-£10,000. Multi-project £10,000-£18,000. Organization-level £18,000-£28,000. All quotes are fixed-price after scoping.
Do you follow the CIS GCP Foundations Benchmark?
Yes. Every GCP engagement includes a control-by-control CIS Google Cloud Platform Foundations v3.0 assessment, plus Security Command Center recommendation review.
Do you test service-account impersonation paths?
Yes. Service-account impersonation is the #1 GCP privilege-escalation path. We map the full impersonation graph using IAM Recommender data plus manual analysis, and identify chains that lead to high-value resources.
Do you test GKE / Kubernetes pod security?
Yes. GKE reviews include Workload Identity boundary scrutiny, RBAC, Network Policies (Calico / Cilium), Binary Authorization (image signing), GKE Autopilot vs Standard differences, and pod-to-node escape paths.
What about multi-project GCP Organizations?
Multi-project testing is fully supported. We map the entire Cloud Resource Manager hierarchy (Organization → Folders → Projects), audit Organization Policies, and test VPC Service Controls boundary enforcement.
Do you test VPC Service Controls?
Yes. VPC Service Controls are the modern GCP data perimeter. We test access level enforcement, ingress / egress rule effectiveness, and identify common bypass patterns (e.g. allowed Google APIs, dry-run mode).
Do you test Cloud Build supply chain?
Yes. Cloud Build supply chain (SLSA framework alignment) is part of cloud reviews. We audit build triggers, service account scope, Artifact Registry permissions, container image signing (Binary Authorization), and OIDC trust into other clouds.
Is testing read-only or do you make changes?
Read-only by default. We use predefined Viewer and SecurityReviewer roles. Manual exploitation phases only run with explicit written authorisation per resource type, in agreed maintenance windows.
Do you provide remediation guidance?
Yes. Every finding ships with prioritised remediation guidance and example Terraform / Deployment Manager / gcloud CLI commands. For high-severity findings we include direct engineer access via our portal during remediation.
Are your testers UK-based and what certifications do they hold?
All GCP testers are vetted UK or international engineers. Relevant certifications: CREST CRT and CCT INF, Google Professional Cloud Security Engineer, OSCP. SC-cleared testers available for public-sector engagements.
Do you sign NDAs?
Yes. Standard NDA before any technical detail is shared. We operate under a project-specific master agreement that includes data handling, deliverable IP, and breach notification clauses.
Book a GCP Security Review Scoping Call
30 minutes with a CREST-certified GCP security specialist. Fixed-price quote within 24 hours. No sales pipeline.
