CREST-Certified GCP Cloud Security Review and GCP Penetration Testing
GCP penetration testing aligned to the CIS Google Cloud Platform Foundations Benchmark. Manual exploitation across IAM, Cloud Storage, GKE, Cloud Functions, Cloud Run, Cloud SQL, Secret Manager, and VPC. Multi-project organisations supported.
What is a GCP security posture review?
A GCP security posture review, also called a GCP configuration review, is a CREST-certified assessment of a Google Cloud organisation against the CIS Google Cloud Platform Foundations Benchmark. Testers audit IAM, storage, GKE and networking configuration, then manually exploit the weaknesses a scanner only flags, and deliver a prioritised hardening plan.
It goes a step beyond a vulnerability scan or a cloud security posture management dashboard: where those list findings, this review confirms what an attacker could actually reach across your projects and prioritises the fixes that close real attack paths.
“Reliable execution and integrity throughout, with sensitive information handled securely.”
– IT Director, International Property Group
GCP scanners flag misconfigurations. We exploit them.
Security Command Center flags overly permissive Cloud Storage buckets and excessive IAM roles. It cannot tell you whether your Cloud Function’s service account can impersonate every other service account in your project, whether your GKE pod can hijack the workload identity, or whether your Cloud Run service has standing access to production secrets.
Our GCP cloud security review combines automated CIS Google Cloud Platform Foundations scanning with manual exploitation across IAM, GKE, Cloud Functions, and the Resource Manager control plane. Reports satisfy ISO 27001 Annex A.13.1, SOC 2 CC6.6, PCI DSS Req 11.3, and align with NCSC cloud security principles. We support UK CHECK alignment for public-sector tenants.
12 GCP SERVICES AUDITED
What a GCP Security Posture Review Covers
Aligned to the CIS Google Cloud Platform Foundations Benchmark v3.0. Multi-project organisations supported via Cloud Resource Manager.
Identity & Access
Service-account impersonation chains, IAM Conditions audit, role recommender review, custom role analysis, group-based access boundary.
Object Storage
Public bucket audit, IAM vs ACL precedence, signed URL leakage, Object Versioning policy, Bucket Lock review.
Kubernetes Engine
Workload Identity boundary, RBAC, Network Policies, GKE Autopilot vs Standard, Binary Authorization, image security.
Serverless
Function service account scope, runtime environment leakage, IAM allow-internal, source code privacy, Pub/Sub trigger auth.
Containerised Apps
Service-account binding, ingress restriction, VPC connector, custom domain TLS, traffic split security.
Managed Databases
Public IP exposure, encryption at rest, automatic backups, IAM database authentication, snapshot privacy.
Secret Manager
Access policy review, rotation enforcement, replication policy, version history retention, Cloud Build secret leakage.
Networking
Default network audit, firewall rule review, Shared VPC, VPC Service Controls, Private Service Connect, BGP routing.
Encryption Keys
Key ring access, automatic rotation, version state management, key policy review, Cloud HSM scope.
Audit Logs
Cloud Audit Logs coverage, sink configuration, log integrity, retention policies, BigQuery export security.
CI/CD Pipeline
Build trigger security, service account scope, Artifact Registry security, supply chain integrity (SLSA).
Resource Manager
Organization policy enforcement, project IAM inheritance, billing account boundaries, folder structure scrutiny.
FOUR-PHASE METHODOLOGY
GCP Cloud Security Review: From Project Inventory to Hardening Plan
Read-only by default. Manual exploitation only with explicit written approval per resource type.
Project Discovery
CIS Benchmark Audit
Manual Exploitation
Report & Hardening
COMPLIANCE READY
GCP Reports Mapped to Every Framework
Findings tagged to CIS Benchmark control IDs and your specific compliance framework. Audit teams submit directly without translation.
CIS GCP Foundations v3.0
Control-by-control compliance score and remediation evidence accepted by enterprise audit teams.
UK CHECK
GCP-specific UK CHECK alignment for public-sector tenants and government suppliers.
ISO 27001 (Annex A)
A.13 network security, A.14 secure development, A.18 compliance: GCP-control evidence ISO auditors accept.
SOC 2 Type I & II
CC6.6 logical access, CC7.1 vulnerability identification, CC7.2 monitoring evidence accepted by SOC 2 auditors.
PCI DSS
Req 1, 2, 7, 8, 11.3 control evidence for GCP-hosted PCI scope, including segmentation and encryption attestation.
NCSC Cloud Security Principles
14 principles assessed for cloud workloads in GCP tenants.
TRANSPARENT PRICING
Transparent GCP Cloud Security Review Pricing
All tiers include the same depth of testing. Price varies by GCP estate complexity: project count, service breadth, resource volume, and Organization scope. Testing GCP plus AWS or Azure? See our multi-cloud penetration testing hub. Running workloads beyond Google Cloud? See our AWS cloud security review and Azure cloud security review.
Depends on GCP estate size
Single project, ≤10 services in use, ≤50 resources, basic IAM. Typically 4-5 day engagement.
Depends on GCP estate size
Cloud Resource Manager folder (3-10 projects), 10-20 services, GKE or Cloud Functions, CI/CD via Cloud Build. Typically 7-10 day engagement.
Depends on GCP estate size
GCP Organization (10+ projects), 20+ services, multi-region, GKE Autopilot + VPC Service Controls + data perimeter. Typically 10-15 day engagement.
GCP Cloud Security Review for Your Sector
GCP deployment patterns vary by sector. We test the controls your regulators specifically require.
Fintech
FCA-regulated firms, Open Banking, payment APIs, PCI scoping.
SaaS
Multi-tenant isolation, SSO/SAML/OIDC, customer-data perimeter, SOC 2 evidence.
Healthcare
NHS DSPT, NHS DTAC, EHR integration, telehealth, patient-data PII.
Insurance
FCA / PRA Operational Resilience, claims data, broker integrations, cyber underwriting evidence.
Law
Privileged-data confidentiality, partner-tier scrutiny, SRA Cyber Standard alignment.
Public Sector
CCS / G-Cloud framework, NCSC-aligned, SC-cleared testers available.
What You Actually Get
Five things that distinguish our service from automated scans and box-tick competitors.
What You Get From GCP Penetration Testing
CIS Benchmark + Manual Combination
Read-Only by Default
Terraform / Deployment Manager Patches
UK CREST + UK CHECK Aligned
A point-in-time review is the start. For continuous coverage between tests, see our penetration testing as a service model.
Frequently Asked
How long does a GCP cloud security review take?
Single-project (≤10 services, ≤50 resources) typically takes 4-5 working days. Folder-level multi-project takes 7-10 days. Organization-level enterprise (10+ projects, multi-region GKE) takes 10-15 days.
How much does GCP penetration testing cost in the UK?
Single-project £6,000-£10,000. Multi-project £10,000-£18,000. Organization-level £18,000-£28,000. All quotes are fixed-price after scoping.
Do you follow the CIS GCP Foundations Benchmark?
Yes. Every GCP engagement includes a control-by-control CIS Google Cloud Platform Foundations v3.0 assessment, plus Security Command Center recommendation review.
Do you test service-account impersonation paths?
Yes. Service-account impersonation is the #1 GCP privilege-escalation path. We map the full impersonation graph using IAM Recommender data plus manual analysis, and identify chains that lead to high-value resources.
Do you test GKE / Kubernetes pod security?
Yes. GKE reviews include Workload Identity boundary scrutiny, RBAC, Network Policies (Calico / Cilium), Binary Authorization (image signing), GKE Autopilot vs Standard differences, and pod-to-node escape paths.
What about multi-project GCP Organizations?
Multi-project testing is fully supported. We map the entire Cloud Resource Manager hierarchy (Organization → Folders → Projects), audit Organization Policies, and test VPC Service Controls boundary enforcement.
What is a GCP configuration review?
A GCP configuration review checks every project in your Google Cloud organisation against the CIS Google Cloud Platform Foundations Benchmark, covering IAM, service accounts, storage, networking and GKE. It is the configuration-audit half of a GCP security posture review, paired with manual exploitation to confirm which misconfigurations are actually reachable.
Is a GCP security posture review the same as a GCP cloud security review?
Yes. GCP security posture review, GCP configuration review and GCP cloud security review all describe the same engagement: a CREST-certified assessment of your Google Cloud organisation against the CIS Foundations Benchmark, combined with manual exploitation across IAM, storage, GKE and networking. The name varies by buyer; the methodology does not.
Do you test VPC Service Controls?
Yes. VPC Service Controls are the modern GCP data perimeter. We test access level enforcement, ingress / egress rule effectiveness, and identify common bypass patterns (e.g. allowed Google APIs, dry-run mode).
Do you test Cloud Build supply chain?
Yes. Cloud Build supply chain (SLSA framework alignment) is part of cloud reviews. We audit build triggers, service account scope, Artifact Registry permissions, container image signing (Binary Authorization), and OIDC trust into other clouds.
Is testing read-only or do you make changes?
Read-only by default. We use predefined Viewer and SecurityReviewer roles. Manual exploitation phases only run with explicit written authorisation per resource type, in agreed maintenance windows.
Do you provide remediation guidance?
Yes. Every finding ships with prioritised remediation guidance and example Terraform / Deployment Manager / gcloud CLI commands. For high-severity findings we include direct engineer access via our portal during remediation.
Are your testers UK-based and what certifications do they hold?
All GCP testers are vetted UK or international engineers. Relevant certifications: CREST CRT and CCT INF, Google Professional Cloud Security Engineer, OSCP. SC-cleared testers available for public-sector engagements.
Do you sign NDAs?
Yes. Standard NDA before any technical detail is shared. We operate under a project-specific master agreement that includes data handling, deliverable IP, and breach notification clauses.
What is a cloud security posture assessment?
A cloud security posture assessment reviews a cloud environment against a recognised benchmark to find misconfigurations and weak controls. For Google Cloud we use the CIS GCP Foundations Benchmark, then go further than an automated tool by manually exploiting the findings to show real, prioritised risk rather than a raw list.
What is the difference between CSPM and a GCP security posture review?
CSPM, or cloud security posture management, is automated tooling that continuously flags misconfigurations. A GCP security posture review is a point-in-time, CREST-certified human assessment that benchmarks the same controls and then proves which weaknesses an attacker could exploit, with a hardening plan your auditors will accept.
20+ CREST-certified testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Book a GCP Security Review Scoping Call
30 minutes with a CREST-certified GCP security specialist. Fixed-price quote within 24 hours. No sales pipeline.
