Oracle Cloud Security Review
In Oracle Cloud Infrastructure (OCI), a single IAM policy can grant manage access to every resource in the tenancy. We test who holds that access and what a compromised instance can reach. CREST-certified testers, fixed price from £2,320 for a 2-day single-tenancy scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
A policy attached at a tenancy’s root compartment is inherited by every compartment created beneath it, including ones that did not exist when the policy was written, so a single broad grant at the top can reach resources several layers down that the policy never names.
Why OCI security comes down to policy inheritance and what a dynamic group can reach
Every resource in an OCI tenancy sits inside a compartment, and Oracle’s own documentation confirms that a compartment created inside another compartment inherits the access permissions of everything above it in the hierarchy, so a policy attached at the tenancy’s root compartment reaches every compartment created underneath it later, whether or not that compartment existed when the policy was written. IAM policies are built from a small set of verbs, and Oracle’s documentation lists inspect, read, use and manage in that order, from least to most access, against either a single resource-type or the all-resources resource-type, which Oracle’s own reference describes as covering all resources in the compartment or the tenancy, so a single statement written as manage all-resources in tenancy grants full control of everything the tenancy contains. We map every policy statement in scope against the verb, resource-type and compartment it actually needs.
That same reach can sit with a person or with a compute instance. Oracle’s own getting-started guide for policies confirms that users added to the Administrators group are able to do anything with any kind of resource under the Tenant Admin Policy that comes automatically with every tenancy, while a dynamic group groups OCI compute instances as principal actors using matching rules against a compartment, an instance OCID or a tag rather than an explicit member list. Oracle’s documentation on calling services from an instance describes instance principals as removing the need to configure user credentials or a configuration file on the instance at all, so whatever policy targets that dynamic group is exactly what the instance, and anything that compromises it, can do. We test which accounts sit in the Administrators group, which matching rules put an instance into a dynamic group, and what policy each group actually grants.
Outside identity, the boundary is drawn by the network and by storage. Oracle’s own comparison recommends network security groups over security lists because an NSG lets you separate a VCN’s subnet structure from the security rules that apply to a specific set of instances, and an internet gateway only carries traffic to a resource that already holds a public IP address, so which subnets and instances have one is where exposure starts. Object Storage buckets are private by default, and Oracle’s documentation recommends pre-authenticated requests over making a bucket public because a pre-authenticated request supports authorisation, expiry and scoping that a public bucket does not. Cloud Guard examines these configurations for known weaknesses, and Oracle’s documentation confirms that Audit logs are kept for 365 days as a tenancy-level setting that cannot be changed, so the record of what happened is fixed even when the policy that allowed it is not. For tenancies that also run workloads on other providers, see our wider cloud penetration testing service.
SCOPE
What we review in an OCI tenancy
Tenancy and Compartment Structure
Every OCI resource sits inside a compartment, and Oracle’s own documentation confirms a compartment created inside another compartment inherits the access permissions of everything above it in the hierarchy, so a policy attached at the tenancy’s root reaches every compartment created underneath it later, including ones that did not exist when the policy was written. We map your compartment hierarchy against where policies are actually attached, and where a broad grant at a parent compartment reaches further down than the team who wrote it intended.
IAM Policy Verbs and Resource-Types
OCI policy statements combine a verb, from inspect through read and use to manage, with a resource-type that can be a single type, a family such as instance-family, or all-resources, which Oracle’s own reference describes as covering all resources in the compartment or the tenancy it is written against. We test every policy statement in scope for a verb or resource-type broader than the role it was written for, and for family or all-resources grants used where a single resource-type would do.
Manage All-Resources in Tenancy and the Administrators Group
A policy written as manage all-resources in tenancy grants full control of every resource the tenancy contains, and Oracle’s own getting-started guide confirms that any user added to the Administrators group is able to do anything with any kind of resource under the Tenant Admin Policy that ships with every tenancy. We map every account and group holding an all-resources or tenancy-wide grant against who actually needs that reach, starting with the Administrators group itself.
Identity Domains and Multi-Factor Authentication
An identity domain is Oracle’s container for a population of users, their federation and sign-on configuration and its own security settings, including MFA, and a tenancy can hold more than one domain with different rules applied to each. We test which authentication factors an identity domain actually enforces for local and federated sign-in, and whether an administrator role scoped to one domain reaches further than the users it was meant to cover.
Dynamic Groups and Instance Principals
A dynamic group adds compute instances as principal actors using matching rules against a compartment, an instance OCID or a tag rather than an explicit member list, and Oracle’s own documentation describes instance principals as removing the need to configure user credentials or a configuration file on the instance to call OCI APIs. We test which matching rules put an instance into a dynamic group, and exactly what the policy attached to that group lets the instance, and anything that compromises it, do.
Security Lists vs Network Security Groups
Security lists apply to every VNIC in a subnet, while Oracle’s own comparison recommends network security groups instead because an NSG applies its rules to a chosen set of VNICs and lets you separate subnet structure from security posture, with a maximum of five of either per subnet or VNIC. We test which control is actually in use, what each rule permits, and whether a security posture that should sit on specific instances is instead spread across an entire subnet.
Internet Gateways and Public IP Exposure
A VCN can have only one internet gateway, and Oracle’s documentation confirms a connection through it needs a public IP address on the resource at both ends, with the subnet’s route table controlling which subnets can reach the gateway at all. We test which subnets and instances actually hold a public IP, whether the route table and security rules in front of them match what the workload needs to expose, and what a scan from outside the tenancy can reach.
Object Storage: Public Buckets and Pre-Authenticated Requests
Object Storage buckets are private by default, and Oracle’s own documentation recommends a pre-authenticated request over making a bucket public because a pre-authenticated request supports authorisation, expiry and scoping that a public bucket does not, though by default it cannot be used to list the objects it covers. We test which buckets have been switched to public, which pre-authenticated requests exist and for how long, and whether any of them expose more than the object or prefix they were created for.
Vault, Keys and Secrets
The Key Management service stores keys and secrets in a vault backed by a FIPS 140-2 Level 3 hardware security module, and a virtual private vault gives you an isolated partition on that HSM rather than sharing one with other tenancies, a choice Oracle’s documentation confirms cannot be changed once the vault is created. We test who can manage or use each vault’s keys, which resources and secrets depend on them, and whether the vault type matches the isolation the data in scope actually needs.
Cloud Guard, Audit and Oracle Services Hosted in Your Tenancy
Cloud Guard examines your OCI resources against Oracle-managed detector recipes and can suggest, help with or take a corrective action, while the Audit service automatically records calls to every supported API endpoint and, Oracle’s documentation confirms, retains them for 365 days as a tenancy-level setting that cannot be changed. We test what Cloud Guard is actually configured to catch and what the audit trail would show; an Autonomous Database or other Oracle product running inside the tenancy is tested under our dedicated Oracle Database security review.
OUR PROCESS
Oracle Cloud Infrastructure Security Review: From Scope to Attestation
Scope and Access
We agree which compartments, regions and OCI services are in scope, plus a federated or local account for every policy tier you want tested and, where useful, read access to compartment and policy configuration.
Policy and Configuration Mapping
We map every IAM policy, dynamic group, identity domain, security list, NSG and public IP in scope against what each is actually meant to grant or expose.
Manual Testing
A CREST-certified tester manually tests policy boundaries, dynamic group and instance principal reach, network exposure, Object Storage access and Vault permissions, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST OCI pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Oracle Cloud Infrastructure Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 4 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test OCI For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Oracle Cloud Infrastructure Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our OCI tenancy?
We need at least one authenticated account or identity-domain sign-in for every policy tier in scope, from an ordinary developer account through to one that can read IAM policies, compartments and dynamic groups for configuration review. Console or CLI access to the compartments in scope covers most of the review; a broader account speeds up policy mapping but is not required to run the manual test itself.
Will testing touch live data?
We test the compartments, policies, network configuration and services you nominate, working against your actual accounts and permissions rather than a copy, so we agree exclusions such as destructive API calls, production Object Storage deletions or live customer data before testing starts. We do not run denial-of-service tests, exceed any bandwidth or resource quota, or export real customer data without that agreement in writing.
Does Oracle have a policy on testing OCI, and do we need Oracle’s approval?
Oracle’s Cloud Security Testing Policy states that testing the resources you have deployed or configured within your own OCI tenancy, rather than the underlying OCI console, APIs or cloud services themselves, needs only prior notification using Oracle’s Testing Request Form, and testing can start five business days after that form is submitted. Testing the underlying OCI service infrastructure itself needs Oracle’s prior approval and a signed Cloud Security Testing Addendum; we confirm Oracle’s current terms and complete the appropriate step with you during scoping.
What is out of scope for a single-tenancy OCI review?
We never test the underlying OCI console, APIs or Cloud Service infrastructure that Oracle operates, and we do not perform denial-of-service or load-testing activity against any Oracle Cloud Service. An Autonomous Database, on-premises Oracle Database or a separately hosted application running inside the tenancy is scoped and quoted on its own; we test the compartments, IAM policies, identity domains, dynamic groups, networking, Object Storage, Vault and Cloud Guard configuration you nominate.
How long does an OCI security review take?
A single tenancy, or a defined set of compartments within a larger tenancy, with a limited number of policies and services in scope sits in our 2-day single-tenancy scope, with a report typically landing around 5 working days after kickoff. More compartments, regions, identity domains or a mix of OCI and other cloud providers moves into a larger scope with more testing days.
Do you test dynamic groups and instance principals?
Yes. We test which matching rules put a compute instance into a dynamic group, and exactly what the policy attached to that group lets the instance do, since that policy is what an attacker inherits if the instance is compromised. We test the reach the policy grants once an instance is assumed to be in that group rather than attempting to compromise the instance itself outside the agreed scope.
Are your testers CREST certified?
Yes. Every OCI engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Oracle Cloud Infrastructure review
In Oracle Cloud Infrastructure (OCI), a single IAM policy can grant manage access to every resource in the tenancy. We test who holds that access and what a compromised instance can reach. CREST-certified testers, fixed price from £2,320 for a 2-day single-tenancy scope, quoted within 24 hours.
