.png){kind=small}
Cloud Security Posture Assessment
Find misconfigurations across AWS, Azure and Google Cloud.
Identity & Access Management Security
Make sure the right people have the right access, and nobody else.
ThreatGaurd reviews your identity provider, multi-factor authentication, privileged access, cloud IAM and access processes, then helps you remove excess access and close the identity gaps that attackers commonly exploit.
Why it matters
Attackers no longer break in. They log in.
Stolen passwords, missing multi-factor authentication and accounts with far more access than they need are among the most common routes into an organisation. Once inside, privileged accounts let attackers move quickly and quietly.
An identity and access management security review shows who can access what across your organisation and cloud, where controls are weak, and how to fix them without slowing people down.
-
Access that only grows
People change roles and keep their old permissions, until a normal account has the power of an administrator.
-
Accounts nobody owns
Former employees, contractors and service accounts stay active long after they are needed.
-
Gaps in multi-factor authentication
Legacy protocols, policy exclusions and admin accounts without MFA leave the easiest way in open.
Identity lifecycle
Access risk builds up at every stage of an employee’s journey.
Identity is not only an IT issue. HR, managers and IT all play a part, so we review how access is granted, changed and removed in practice.
-
Step 1: Joiner
A new starter receives access, often copied from a colleague who has more rights than they need.
What we check
Role-based access and approval for new accounts
-
Step 2: Mover
A role change adds new access, but the old access is rarely removed.
What we check
Access changes when people change roles
-
Step 3: Leaver
Accounts, tokens and shared passwords stay active after someone leaves.
What we check
Timely removal across every system and cloud
-
Step 4: Review
Managers approve long access lists without the context to spot what is wrong.
What we check
Access reviews that actually remove access
What we assess
Every identity, human and machine, across your organisation.
We review the platforms and processes that control access. The exact scope is agreed with you during scoping.
-
Identity provider and single sign-on
Microsoft Entra ID, Okta, Google Workspace and other identity platforms.
- Tenant and directory security settings
- Single sign-on coverage for business applications
- Guest and external user access
-
Multi-factor and conditional access
The controls that stop a stolen password from becoming a breach.
- MFA coverage, exclusions and weaker methods
- Conditional access and risk-based policies
- Legacy authentication that bypasses MFA
-
Privileged access
Administrator, root and other high-impact accounts.
- Number and use of standing admin accounts
- Just-in-time and approval-based elevation
- Emergency and break-glass accounts
-
Cloud IAM
Roles and permissions across AWS, Microsoft Azure and Google Cloud.
- Over-privileged roles and wildcard permissions
- Cross-account and cross-project trust
- Unused permissions and access keys
-
Service accounts and machine identities
Non-human identities used by applications, scripts and integrations.
- An owner and purpose for every service account
- Rotation of secrets, keys and certificates
- Interactive sign-ins with service accounts
-
Access governance
The processes that keep access right over time.
- Joiner, mover and leaver processes
- Access reviews and recertification
- Segregation of duties for critical systems
How it works
From read-only access to verified fixes, in five steps.
-
01
Scope and connect
We agree the identity platforms, clouds and applications in scope, and you grant read-only access. An NDA is signed before any access.
-
02
Review configuration
We review identity provider, multi-factor, conditional access, privileged access and cloud IAM settings.
-
03
Map who can access what
We map effective permissions, find excess and unused access, and identify paths to privileged roles.
-
04
Review the processes
We walk through joiner, mover, leaver and access review processes with IT, HR and system owners.
-
05
Report and verify
You receive the reports and a walkthrough, and we verify fixes once they are made.
Deliverables
Clear actions for IT and security, and a summary leaders can act on.
- Executive summary A short overview for leadership: overall risk, key issues and what to do next.
- Identity risk findings Every finding with severity, affected accounts and systems, evidence and clear remediation steps.
- Privileged access inventory Every privileged account and role, who holds it and whether it is still needed.
- Access clean-up list Inactive accounts, unused permissions and orphaned service accounts to remove or reduce.
- Identity roadmap Prioritised improvements to MFA, privileged access and access processes, from quick wins to longer-term changes.
Overall risk
High → Low after retest
- Critical
- 2
- High
- 6
- Medium
- 10
- Low
- 7
Open findings
25before retest,4after retest
Fix first
Former employee accounts still active in the identity provider
Owner: IT and HR · 1 day
Related services
Go further after the review.
-
-
Endpoint & Infrastructure Security Assessment
Find attack paths through Active Directory, servers and endpoints.
-
Multi-Cloud Security
One consistent security standard across every cloud you use.
-
Virtual CISO (vCISO)
Ongoing security leadership to drive identity improvements.
FAQ
Questions leaders ask about identity and access security
Can’t find your answer? Our team is happy to help.
What does an IAM security review cover?
Your identity provider and single sign-on, multi-factor authentication and conditional access, privileged access, cloud IAM, service accounts, and the processes for granting, changing and removing access. The exact scope is agreed during scoping.
Which identity platforms do you review?
Common identity providers such as Microsoft Entra ID, Okta and Google Workspace, on-premises Active Directory, and IAM in AWS, Microsoft Azure and Google Cloud. Tell us what you use during scoping and we will confirm the approach.
What access do you need?
Read-only access to the identity platforms and clouds in scope, usually through dedicated accounts or roles that you create and can remove at any time. Nothing is changed during the review.
Why are HR and managers involved?
Many access problems start with people processes: new starters, role changes and leavers. We speak briefly with HR and system owners to see how these work in practice, so fixes address the cause, not just the symptoms.
Will this help us move towards zero trust?
Yes. Strong identity, multi-factor authentication and least-privilege access are the foundation of a zero trust approach. The review shows where you stand today and which steps to take first.
How long does an IAM review take?
Most reviews take 1 to 3 weeks, depending on the number of identity platforms, clouds and applications in scope.
How is the cost calculated?
Cost depends on the number of identity platforms, clouds and applications, and the size of your user base. After the scoping call you receive a fixed-scope proposal, so the cost is agreed before work starts.
Will your report support ISO 27001, SOC 2 or PCI DSS?
All three expect access to be controlled, reviewed and removed when it is no longer needed. Our findings and access evidence support those requirements. The final audit opinion always rests with your auditor.
Get started
Find out who really has access to what.
Tell us which identity platforms and clouds you use. We will come back with a clear scope and proposal, with no obligation.
What happens next
- A short scoping callWe learn your goals, environment and timelines.
- A fixed-scope proposalClear scope, approach, timeline and cost, in writing.
- Testing on your scheduleTesting starts on the agreed date, with regular updates.