We work with teams running production on Oracle Cloud and Azure. Where most consultancies hand you an opinion, we hand you a measurement: what we observed, on which resource, from which API call. You should be able to check our work, and we build so that you can.
Maturity assessment measured from your own APIs, IAM and policy design, network segmentation, vulnerability prioritisation that ranks by real exposure rather than CVSS alone, and edge and WAF governance.
Defining SLOs the business recognises and engineering can act on, observability that answers questions rather than filling dashboards, incident practice, and the capacity and cost work that keeps reliability affordable.
Getting agents and model services past the prototype: MCP integrations into your existing estate, evaluation you can trust, guardrails, and admission control so inference cost stays bounded under real load.
Landing zones and tenancy design, multi-cloud architecture where it is genuinely warranted, migration planning, and the platform automation that stops the second year undoing the first.
Where most engagements start
Most clients begin here, because it is the cheapest way to find out whether we are any good. Two weeks, read-only access, and a report that scores 44 controls against a catalogue written down before we look at anything. It is also the clearest illustration of how the rest of the practice works — this is an extract from one.
How we work
This is the discipline that runs through every engagement, not just assessments. If we could not see something, that is a gap in our work — not a weakness in yours. We label it, exclude it from any score, and tell you exactly what would close it.
Everything we state carries one of four labels, and our documents use these words throughout.
Assessment work needs read permissions and nothing more. Where an engagement involves change, it happens through your own pipelines and your own review, never through a back door we hold.
Each compartment, subscription and account is assessed separately. A control enforced in production and absent in a sandbox sharing the same network is not enforced, and we name the scope rather than averaging it away.
Most questions are answerable from your own APIs. Asking your engineers to describe their network rules wastes their time and gets a worse answer than reading them.
The findings, the evidence, the scripts and the catalogue used to produce them. No engagement leaves you dependent on us to understand your own estate.
Allow group CloudAISecAssessors to inspect compartments in tenancy Allow group CloudAISecAssessors to inspect policies in tenancy Allow group CloudAISecAssessors to inspect virtual-network-family in tenancy Allow group CloudAISecAssessors to read cloud-guard-configuration in tenancy Allow group CloudAISecAssessors to inspect secret-family in tenancy
Your IAM team gets the complete pack before anything starts — generated from the exact calls the work makes, not written by hand. Every verb is inspect or read; use and manage appear nowhere. No secret value, object content, log entry or database row is ever read — configuration only.
Working together
Most relationships start small and deliberately reversible. You should be able to find out whether we are worth keeping before committing to anything that matters.
A fixed-scope measurement of where you stand, with a report, the evidence behind every finding, and a prioritised order to fix things in. The usual starting point.
A named engineer available to your team on a recurring basis — design review, second opinion on an architecture, a sounding board before a decision gets expensive.
A defined piece of work built and handed over: a landing zone, a segmentation programme, an observability rebuild, an agent integration into your existing systems.
We work inside your team for a fixed period — standing up a practice, carrying a migration through, or covering a gap while you hire. The aim is always to leave capability behind.
Who you would be working with
CloudAISec is an independent consultancy working on cloud security, reliability and applied AI. The people who scope your engagement are the people who do it — there is no layer between the conversation you have and the work you get.
The practice grew out of building security tooling for large cloud estates: the kind of systems that have to be right because somebody acts on their output. That shaped how we consult. We would rather spend a week instrumenting something than an afternoon estimating it, and we would rather tell you what we could not determine than round it up into a finding.
We stay small on purpose. It keeps senior people on the actual work, and it means we turn down engagements we are not the right firm for — which is usually more useful to you than the alternative.
Next step
A first call takes thirty minutes and costs nothing. Bring the problem rather than a brief — we will tell you what we would do about it, what it would take, and whether we are the right people for it. Sometimes the answer is no, and that is a useful thirty minutes too.
[email protected]
Engagements run remotely, in your time zone.