Cloud Security & Configuration Review
Secure by design, not by default.
Default settings in Microsoft 365, Google Workspace, AWS and Azure leave gaps attackers know how to find. Our independent configuration reviews find them first, and show you exactly how to fix them.
Why configuration matters
Many breaches start with a setting.
Cloud platforms and network devices are only as secure as the way they’re configured. A sharing setting left open, an unused admin account, a permissive firewall rule or a flat VPN network can give an attacker everything they need, without exploiting a single vulnerability.
Our consultants review your configuration against recognised good practice and the risks that matter to your business, then give you a prioritised list of changes. We don’t change your settings; we tell you what to change and why.
- Microsoft 365: Exchange Online, Teams, OneDrive and SharePoint
- Google Workspace and connected third-party apps
- AWS and Azure infrastructure
- Firewall rule bases and device configuration
- VPN access and network segmentation
- Server and workstation builds
Reviews we run
Choose the review you need.
Microsoft 365 configuration review
Identity, sharing, email and data protection settings across the applications you use.
Find out more →Google Workspace configuration review
Licensing, user settings and third-party app access in your Workspace tenant.
Find out more →AWS and Azure configuration review
The services you run, how they connect, and who can reach them.
Find out more →Firewall review
Rule bases and, optionally, each appliance’s overall configuration.
Find out more →VPN review
User groups, access and segmentation from the rest of your network.
Find out more →Build and configuration review
Operating system and application server builds against good practice.
Find out more →By the numbers
The threatin numbers.
-7 days
mean time to exploit a new vulnerability: exploited before a patch exists
Source: Mandiant M-Trends 2026
31%
of breaches start with vulnerability exploitation, now ahead of stolen credentials (13%)
Source: Verizon DBIR 2026
29
UK incidents handled by the NCSC traced to just three edge-device and server flaws
Source: NCSC Annual Review 2025
34%
of UK businesses apply security updates within 14 days
Why CyberQ Group
Expertise you can rely on.
CREST accredited
Independent testing to a standard recognised by government, regulators and insurers.
ISO 27001 certified
We hold ourselves to the same standard we help our clients achieve.
Globally resilient, 24/7/365
Teams in multiple locations, so cover never depends on a single site.
Birmingham HQ, five regions
Headquartered in Alpha Tower, supporting organisations across the UK, Europe, South Africa, the US and Asia.
Related services
Explore further.
Attack Surface Management
Continuous discovery of everything you expose to the internet.
Explore →Penetration Testing
Independent, CREST-accredited testing of your defences.
Explore →Vulnerability Management
Continuous scanning with risk-based priorities for remediation.
Explore →Managed XDR
24/7 threat detection and response from our Security Operations Centre.
Explore →
It depends on scope: the number of users and applications, firewall appliances and rules, or cloud resources. Answer the scoping questions in AskQ’s Scope Builder and we’ll send a tailored proposal.
We’ll agree the right level of access with you before we start. For some reviews, such as firewalls, admin access gives the most complete result; for others, read-only access is enough.
No. A configuration review looks at how your systems are set up; we don’t make changes. You decide what to change, and when.
A clear report of what we found, why it matters and how to fix it, prioritised by risk, so your team or IT provider can act straight away.
AskQ Scope Builder
Need a quote? Scope it now.
Answer the technical scoping questions online and our team will come back with a tailored proposal.
Get started
Talk to our team.
Book a call with a CyberQ specialist, or call us on 0800 0614 715. No obligation, no jargon.