Cloud Security Posture Management For A Hyper-Growth SaaS Company

You cannot secure what you cannot see, so we started by connecting every AWS account and Azure subscription to a single inventory. Within days, the security team had a live view of every workload, database, storage bucket and identity across both clouds for the first time. No agents or code changes were needed to get started.

The inventory surfaced resources nobody remembered creating, including test environments with production data, abandoned virtual machines and duplicated databases. Each asset was tagged with an owner, environment and data classification, so every future finding could be routed straight to the team responsible for it instead of landing in a shared inbox.

The inventory now updates automatically as teams build and retire infrastructure. It has become the foundation for everything else in the programme, from risk reporting to cost reviews, and gives leadership a clear answer to one simple question: what do we actually run in the cloud? Monthly reports now show how the estate is changing, so growth never outpaces the team's ability to secure it.

With a full inventory in place, we assessed every resource against CIS benchmarks and cloud provider best practices. The audit identified more than 140 misconfigurations, ranked by severity, exposure and the sensitivity of the data involved, so the team always knew what to fix first. Every result was checked by hand before being reported.

The most urgent issues were fixed within 48 hours, including 23 publicly accessible storage buckets, six of which held production customer data. We also closed open management ports, enabled encryption on unprotected databases and removed default network rules that allowed unrestricted inbound traffic from anywhere on the internet.

Every finding was recorded with clear evidence, a business impact rating and step-by-step remediation guidance. Within six weeks, all critical and high-severity issues had been resolved, and the remaining lower-risk items were scheduled into normal engineering sprints with named owners and target dates. A follow-up scan three months later confirmed that none of the critical issues had returned.

Identity is the new perimeter in the cloud, and it was where the company's biggest hidden risks sat. We reviewed every user, role and service account across both clouds, comparing the permissions each one had with the permissions it had actually used. Unused permissions were measured over a 90-day window.

Dozens of roles had wildcard permissions granting full administrative access, often created as quick fixes during tight deadlines and never revisited. Several former employees still had active access keys, and a number of service accounts shared credentials across production and development environments, making any single compromise far more damaging than it needed to be.

We replaced broad permissions with least-privilege roles generated from real usage data, removed stale accounts and enforced short-lived credentials for automated systems. The number of identities with administrative access fell by more than 80%, without slowing down any engineering team's day-to-day work. Access reviews now run automatically every quarter, so permissions stay tight as teams and responsibilities change.

Manual fixes do not scale with 200 engineers, so we built automated remediation for the most common issues. When a risky configuration appears, the platform corrects it within minutes and notifies the owning team with a clear explanation of what changed and why. Every automation was tested in a sandbox before going live.

Automations now cover around 80% of misconfiguration types, from public storage and missing encryption to disabled logging and overly permissive network rules. Changes that could affect production are routed for quick approval in Slack instead of being applied automatically, so safety never comes at the expense of availability or customer experience.

Mean time to remediate dropped from several weeks to around 30 minutes. The two-person security team no longer spends its days chasing tickets, and can focus on higher-value work like threat modelling new features and advising engineering teams on secure design. Every automated fix is logged in full, giving auditors a clear record of what changed, when and exactly why.

Most of the company's infrastructure was defined in Terraform, which meant we could catch problems before they ever reached the cloud. We added security scanning to every pull request, so risky changes are flagged while the engineer is still working on them. The same policies now apply everywhere, in code and in the cloud.

Checks cover public exposure, encryption, logging, network rules and identity permissions, using the same policies as the live cloud audit. Clear inline comments explain each issue and suggest a fix, so engineers can resolve problems in minutes without needing to wait for help from the security team or open a separate ticket.

Within a month, the number of new misconfigurations reaching production fell by more than 70%. Security moved from a gate at the end of the process to a helpful check built into it, and engineering teams now treat the scanner as part of their normal code review. Engineers now suggest new checks themselves, helping the ruleset grow in step with the company's platform.

When we started, 40% of Azure resources had no logging enabled, leaving the company blind to any suspicious activity. We enabled audit, network and access logging across both clouds and centralised it in a single, searchable location with sensible retention periods. Retention was set to match both legal and audit requirements.

On top of the logs, we built alerts for high-risk events such as new public resources, disabled security controls, unusual login locations and mass data downloads. Alerts are enriched with asset ownership and data sensitivity, so the security team can judge the real impact of each one in seconds rather than hours of manual research.

The company now has full visibility of activity across 14 AWS accounts and 4 Azure subscriptions. If something goes wrong, investigators have the evidence they need, and the security team is alerted to genuine threats quickly instead of discovering them weeks later by chance. Log data has already helped the team investigate two suspicious events in hours rather than days.

The company needed to prove its security to auditors, customers and investors, not just improve it. We built a live compliance dashboard mapping every cloud control to SOC 2 and CIS benchmark requirements, updated automatically as the environment changes. Controls were mapped once and reused across every framework.

Evidence that once took weeks to gather by hand is now collected continuously, from encryption settings to access reviews and logging coverage. Auditors receive read-only access to exactly what they need, and the sales team can answer customer security questionnaires with confidence and up-to-date evidence instead of vague promises.

The SOC 2 Type II audit was completed three months ahead of the original plan. The dashboard also gives the board a simple, visual summary of cloud risk each quarter, replacing long technical reports that few people outside the security team were able to read. Customer security reviews that once took weeks are now answered in days, helping the sales team close deals faster.

The final step was making sure the problems could not simply come back. We introduced preventive guardrails at the organisation level in both clouds, blocking the riskiest actions entirely while leaving teams free to build everything they genuinely needed. Guardrails were agreed with engineering leads before rollout.

Public storage, unencrypted databases and resources in unapproved regions are now impossible to create, even by administrators. New accounts are created from a secure baseline template, with logging, encryption and monitoring switched on from day one, so every team starts from a safe position without needing to remember a long checklist.

Since the guardrails went live, no critical misconfiguration has reappeared. The company passed its Series-D security due diligence with zero critical findings, and now has a cloud security foundation designed to scale smoothly as the engineering team grows well beyond 200 people. New engineers are productive on day one, because safe defaults are built into every account they are given.