Cloud Security Services

Kroll’s multi-layered approach to cloud security consulting services merges our industry-leading team of AWS and Azure-certified architects, cloud security experts and unrivaled incident expertise.

Talk to an Expert
/en/services/cyber-risk/assessments-testing/cloud-security-services service

Whether your organization is large or small, new to the cloud, or early cloud adopters, Kroll understands how unique and evolving complexities play out across a full range of industries. With over 3,000 incidents investigated and 53,000 hours of security assessment work completed every year, we deliver practical guidance to help your organization grow profitably and securely.

Cloud Security Consulting, from the Ground Up

Kroll partners with you to understand your current cloud security posture to design a cloud security program that provides continuous validation and governance of your cloud environment, all while enabling your business to thrive. As your partner, we offer services to guide you through every step of a secure cloud adoption journey:


Security architecture review services help ensure that cloud environments are designed with security from the beginning, creating a resilient, secure and scalable cloud platform for your business that aligns with industry standards and best practices.


Cloud penetration testing services provide assurance infrastructure/ systems in the cloud are implemented as designed and security controls are effective.


Cloud governance and operations assessments review security controls and monitoring of cloud assets. Successful deployment of policy and monitoring tools makes sure that cloud environments are always compliant with regulatory requirements, corporate standards and industry best practices.


Kroll incident response services are at the ready to respond to any security incident that affects your cloud assets.

Discover Kroll’s approach to cloud migration strategy with Louis Muniz, VP of Cloud Security Services Advisory.


Cloud Security Consulting Services

Kroll has deep knowledge of cloud environments and the process for building security into diverse cloud deployments, including interactions between your users and critical cloud services. With frontline insights from handling thousands of cloud security incidents, we focus on reducing accidental data exposures, as well as preventing unauthorized actors from gaining access to your environment.

Cloud Security Assessments

Kroll’s cloud security assessments integrate overall security best practices with measures that are customized to your organization’s specific cloud architecture and risk tolerance. For example, as a matter of best practices, our seasoned practitioners will examine several key areas, including but not limited to, the following:

  • External network access control
  • Internal network access control
  • Identity and access management
  • Multi-factor authentication and federated access
  • Encryption and data security
  • Backup and disaster recovery
  • Security event logging, correlation and alerting
  • Incident response planning

Discover Kroll’s approach to cloud migration strategy with Louis Muniz, VP of Cloud Security Services Advisory.

  • External network access control
  • Internal network access control
  • Identity and access management
  • Multi-factor authentication and federated access
  • Encryption and data security
  • Backup and disaster recovery
  • Security event logging, correlation and alerting
  • Incident response planning

For clients who are considering or have chosen specific cloud services, Kroll’s cloud security risk assessments will focus on evaluating the configuration and controls for that specific deployment. Sample engagements include:

Microsoft 365

Microsoft 365 Email Security Assessments

Identifies material gaps or significant shortcomings in a client’s email security defenses. Check out this M365 business email compromise case study.

Read More
Cloud Security Services

Google Workspace Email Security Assessments

Focuses on Workspace configuration for email, drives and content compliance, policies for phishing prevention, workstation defenses and end-user awareness.

Cloud Security Services

AWS Cloud Security Assessments

Reviewing AWS security groups, identity and access management (IAM), access control lists, relational databases, EC2 instance lifecycles and more.

Cloud Security Services

Google Cloud Security Assessments

Uncovers potential gaps in configuration and document storage in addition to IAM, logging, virtual machines and the Kubernetes engine.


Cloud Penetration Testing and Vulnerability Management 

Independent configuration reviews and penetration testing can deliver the findings that are the ultimate gauge of your cloud security defenses. Kroll’s team of offensive security experts will approach your environment from an attacker’s perspective to identify any weaknesses in your cloud applications or infrastructure. Remediation guidance will incorporate the business requirements of a system and present approaches that leverage the vast security features available from Cloud Services Providers, to provide a practical strategy to defend your cloud environment. 

Our experts are experienced in using a wide variety of assessment tools as well as manual attack techniques to uncover weaknesses that are often missed in cloud services. Coupled with industry certified penetration testing experts, we bring real-world tactics, techniques and procedures (TTPs) typically deployed by successful criminals to compromise cloud services.

Cloud Incident Response Management and Planning

Kroll’s digital forensics experts investigate hundreds of cloud security incidents annually. Our decades of investigative incident response experience and advanced intelligence collection and correlation enable us to respond quickly, efficiently, and effectively.

Kroll understands that a major concern for most clients experiencing a cloud incident is whether sensitive data was compromised. Our wealth of investigative experience and knowledge translates to unrivaled expertise in assessing and identifying files that are likely to contain sensitive data. Our team of experts also leverage advanced analytics to assist in identifying files that do not require review for sensitive data and perform statistically valid sampling to verify the results, reducing time and cost.

Cloud Migration Security Consulting

Like most businesses, you are either thinking about migrating to the cloud or increasing operations in the cloud. The flexibility and cost savings are a competitive advantage that you cannot pass up. However, to avoid the time, money and reputational costs of a data breach, as well as to save time and money through the course of the migration, you need to plan carefully and ask the right cloud migration security questions

Kroll’s cloud security consulting provides technical expertise, insight and resources to evaluate every aspect of a company’s security program. Our experts offer advice on all facets of your program from policies and procedures to human influences and technical controls for every data touchpoint in your organization.

In addition to our years of experience with cloud technologies, our collaborative and communicative approach means we work with you to learn your business, help break down the silos between departments and design cloud security that helps you reach your goals. 

Remote Work Security

The rise of remote work has meant that risk and security leaders are presented with an interesting challenge: How to maintain seamless employee productivity while actively evaluating physical and cyber security controls to ensure data remains protected within the cloud environment? Hurdles generated by remote work include the use of VPNs, personal devices, cloud storage repositories, shadow IT systems and more.

We methodically review your existing and new policies for securing a remote workforce as well as interview your IT, information security, and remote workers to identify where your defenses are strong and where vulnerabilities exist that bad actors can exploit.

Watch the video or visit our Remote Work Security Assessment page to learn more.


Fortify Your Defenses and Response Resources 

You can be certain that cyber attackers are aware of security gaps resulting from cloud implementations with weak security measures. Kroll’s cloud security specialists leverage unrivaled knowledge to help you navigate the unique risks the cloud presents, so you’re in a better position to protect your data and respond to an incident.

Cloud Security Partners

We don’t just provide a report and walk away. We become an extension of your team, collaborating with you from start to finish to support your security, compliance and ultimate success with cloud technologies. Our proprietary data, technology and insights help our clients stay ahead of today’s complex demands.


Certified Cloud Expertise

The professionals at Kroll have certifications that cover all the leading cloud service providers. We have industry-leading experience across many AWS services, including EC2, Lambda, S3 and Cognito. We enjoy deep expertise in Azure Virtual Machines, Azure Functions, Blob Storage and Azure Active Directory, as well as the Google Cloud Platform. We are ready to help secure your Kubernetes and containerized workloads in all cloud environments from EKS, ECS, Fargate to AKS and GKE.

Proven Cloud Expertise

Our team of consultants executed over 25,000 hours of cloud security assessments across AWS, Azure, and Google Cloud Platform in 2021. We work extensively with leading cloud tools such as Dome9, Prisma and ScoutSuite.

Cloud Security Consulting as Part of a Cyber Risk Retainer

Kroll offers cloud security consulting services that can be delivered as part of a cyber risk retainer while providing you with prioritized access to Kroll’s elite team of incident response specialists.

Frequently Asked Questions

Why do I need a cloud-specific security strategy?

Many companies think they can move their infrastructure to the cloud without making fundamental changes to their security protocols. But shifting from on-premises infrastructure to the cloud is not a trivial move. The cloud operates differently from a traditional IT environment, meaning there are unique security considerations to keep in mind. Whether you’re migrating to the cloud, operating in a hybrid cloud environment or taking a cloud-first approach, you’ll need a cloud-specific strategy to address risk.

What security questions should I ask when migrating to or operating in the cloud?

Integrity and privacy are your key goals. You’ll want to consider: Are my company’s security policies built for the cloud? What type of data do I maintain and who needs access? Do I have any data residency requirements? Which cloud provider will I work with, and what capabilities and responsibilities does that cloud provider have? A cloud security provider like Kroll can help you address these questions.

What are the top issues a cloud security strategy will address?

According to Gartner, through 2024, most enterprises will continue to struggle with appropriately measuring cloud security risks. Common cloud risks include security misconfigurations and challenges with data security. By establishing a cloud security strategy, you can make sure you have a cloud policy that addresses cloud-specific risks. Additionally, you can plan for regular security testing to verify that the controls your business has in place are properly implemented and are providing the protection your business needs.

Related Team

Connect with us

Keith Novak
Keith L Novak
Managing Director
Cyber Risk
New York
Jeff Macko is a Director
Jeff Macko
Associate Managing Director
Cyber Risk
Alex Cowperthwaite
Alex Cowperthwaite
Technical Director of Research and Development
Cyber Risk
James McLeary is an associate managing director in the Cyber Risk practice of Kroll, a division of Duff & Phelps, based in Hong Kong.
James McLeary
Managing Director
Cyber Risk
Hong Kong

See all servicesStay Ahead with Kroll


Valuation of businesses, assets and alternative investments for financial reporting, tax and other purposes.

Compliance and Regulation

End-to-end governance, advisory and monitorship solutions to detect, mitigate and remediate security, legal, compliance and regulatory risk.

Corporate Finance and Restructuring

Middle Market M&A, Strategic Advisory, Debt Advisory and Private Capital Markets, Restructuring and Insolvency Services, Financial Due Diligence, Fairness Opinions, Solvency Opinions and ESOP/ERISA Advisory.

Cyber Risk

Incident response, digital forensics, breach notification, managed detection services, penetration testing, cyber assessments and advisory.

Environmental, Social and Governance

Advisory and technology solutions, including policies and procedures, screening and due diligence, disclosures and reporting and investigations, value creation, and monitoring.

Investigations and Disputes

World-wide expert services and tech-enabled advisory through all stages of diligence, forensic investigation, litigation, disputes and testimony.

Business Services

Expert provider of complex administrative solutions for capital events globally. Our services include claims and noticing administration, debt restructuring and liability management services, agency and trustee services and more.

Cyber Governance and Risk

The Economics of Secure Software Development

Mar 23, 2023

by Rob Deane

Threat Intelligence

Q4 2022 Threat Landscape Report: Tech and Manufacturing Targeted as Ransomware Peaks for 2022

Feb 15, 2023

by Laurie IaconoKeith Wojcieszek George Glass


Techniques for Effectively Securing AWS Lake Formation

Jan 25, 2023

by Alex Cowperthwaite Pratik Amin


Live from Davos – Cyber in 2023: Geopolitical and Economic Risks

Jan 16, 2023

by Jason N. SmolanoffMegan  Greene

Press Release

Kroll Responder Recognized in 2023 Gartner Market Guide for Managed Detection and Response Services for the Third Consecutive Year

Mar 23, 2023


Kroll Launches Cyber Partner Program Delivering Lifetime Returns

Feb 28, 2023


Kroll Named an MDR “Champion” by Bloor Research

Feb 27, 2023

Press Release

Gartner Names Kroll a Representative Vendor for Managed Security Incident and Event Management

Jan 09, 2023


Kroll at RSA Conference 2023

Conference Conference Apr 24 - Apr 27, 2023 | Conference


KAPE Intensive Training and Certification

Online Event Online Event Apr 13 - Dec 07, 2023 | Online Event