Find out what’s exposed in your AWS account.
A read-only audit across 637 checks in every active region. You get a security risk score, the three fixes that matter most, and the wasted spend we can find and price - in under ten minutes.
- No credentials shared
- Nothing in your account is modified
- Revoke in one click
The free report is genuinely useful on its own.
Most “free audits” are a lead form with a number attached. This one hands you three fixes you can action today, whether or not you ever speak to us. That is deliberate. It is how you find out whether we know what we are doing.
- A risk score you can interrogate
- One number, 0 to 100, lower is better. Every point is traceable to a specific finding or missing control, and we publish the full rubric. No black box.
- Severity breakdown by region
- Critical, high and medium findings across every active region, each tied to the exact resource identifier so your team can go straight to it.
- Three fixes, fully worked
- Not "enable logging". The literal console click-path, the CLI command, the time it takes, and confirmation that it will not disrupt anything.
- Compliance mapping
- Every finding mapped to the SOC 2, ISO 27001, GDPR and CIS controls it breaches. Useful the next time a customer sends you a security questionnaire.
EC2 → Security Groups → sg-0a1b2c3d4e5f60718 → delete the inbound rule 0-65535 from 0.0.0.0/0.
aws ec2 revoke-security-group-ingress \ --group-id sg-0a1b2c3d4e5f60718 \ --protocol -1 --port 0-65535 \ --cidr 0.0.0.0/0
Three steps. Nothing installed, nothing changed.
Connect in one click
You deploy a CloudFormation stack in your own account. It creates a read-only IAM role scoped by an external ID unique to you. You never send us a credential, because there is no credential to send.
We scan, read-only
637 checks across every region with active resources, covering IAM, network exposure, encryption, logging, threat detection and workload configuration - plus a sweep for idle and abandoned resources you are still paying for.
You get your score
Risk score, three fully worked quick wins, and the money the account is wasting - each item priced from AWS’s published rates so you can check it against your own bill. The complete findings register and 90-day roadmap come in a walkthrough with the engineer who ran the scan.
- us-east-1118
- eu-west-174
- ap-south-141
- me-central-129
Regions nobody watches are where exposure hides. We scan them all, not just production.
A scan follows your resources, not a region list you maintain. Production usually looks tidy because someone is watching it. The exposure tends to sit in a region nobody opened in a year, which is exactly where an attacker looks and your dashboards do not.
We ask for the least access that does the job.
Granting a third party access to your AWS account is a serious decision and you should treat it as one. Here is exactly what the role can do, and how to take it away.
SecurityAudit and ViewOnlyAccess, both published and maintained by AWS. You can read what they grant in AWS documentation rather than trusting our JSON.
The role cannot create, modify or delete any resource. Even a total compromise of our infrastructure could not change anything in your account. AWS enforces this, not us.
Prevents the confused-deputy attack: without it, anyone learning our role ARN could induce us to assume a role in an account they do not own.
Delete the CloudFormation stack and our access ends immediately. You do not need to contact us, and we cannot prevent it.
AuditRole:
Type: AWS::IAM::Role
Properties:
RoleName: ScionTechAuditRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/SecurityAudit
- arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
AWS: !Sub 'arn:aws:iam::${TrustedAccount}:root'
Action: sts:AssumeRole
Condition:
StringEquals:
sts:ExternalId: !Ref ExternalIdThe people reading your report have fixed this before.
DDoS mitigation via CDN and WAF, infrastructure moved into private subnets, geo-replicated database for availability.
Frontend Varnish caching, plus a centralised Infrastructure-as-Code repository to track security group changes after an autoscaling incident.
Legacy EC2 re-engineered onto ECS Fargate, with budget alerts that caught a 30% NAT Gateway cost surge from a failing task.
Ten-plus years running AWS infrastructure for media, fintech and SaaS clients. The engineer who reviews your findings is the one who wrote the checks, not a salesperson working from a script.
The things people actually ask.
What access do you need?
A read-only IAM role in your account, created by a CloudFormation stack you deploy yourself. It attaches two AWS-managed policies, SecurityAudit and ViewOnlyAccess, so you can verify exactly what it grants without reading our JSON.
Can you change anything in my account?
No. The role carries no write permissions of any kind. Even if our scanner were compromised, it could not modify, delete or create a single resource. This is enforced by AWS, not by our promise.
How do I revoke access?
Delete the CloudFormation stack. Access ends immediately. No email, no support ticket, no waiting on us.
What is the external ID for?
It prevents a confused-deputy attack. Without it, anyone who learned our role ARN could induce us to assume a role in an account they do not own. Yours is generated server-side and is unique to you.
What do you store, and for how long?
Scan findings and the generated report, encrypted at rest. We do not store credentials. There are none to store. Findings are deleted on request at any time, and we keep retention short by default.
Is it really free? What is the catch?
The audit is free and the three quick wins are yours to action whether or not you ever speak to us. We do it because a meaningful share of people who see their score want help fixing it, and that is the business. No card, no trial, no auto-renewal.
What happens after the scan?
You get your score, severity breakdown and three highest-impact fixes immediately. The full findings register, compliance mapping and 90-day remediation roadmap come in a 30-minute walkthrough with the engineer who ran the scan.
Which regions do you scan?
All regions with active resources, detected automatically. Findings in unused regions matter. An exposed security group in a region nobody watches is worse than one in production, not better.
Ten minutes to find out where you stand.
No card, no trial, no auto-renewal. Three fixes you can action today, and an honest conversation about the rest.