Cloud and infrastructure penetration testing
Contracts run on infrastructure, and infrastructure is administered by people with credentials. Guardian treats your cloud footprint the way an intruder would: as a set of accounts to escalate through until something signs.
Offchain · Infrastructure Pentest
The servers, accounts, and vendors your protocol depends on.
- Cloud posture IAM roles and trust policies, over-broad permissions, exposed storage, network reachability, and what a single stolen access key unlocks.
- Data at rest Database exposure, encryption and key custody, backup access, and whether a provider compromise reads your data in the clear.
- Secrets handling Where keys and tokens live, who and what can read them, rotation in practice, and what stays valid after an employee leaves.
- Build and deploy CI/CD runner permissions, dependency and artifact integrity, and whether a compromised pipeline can ship or sign on your behalf.
- Containers and clusters What is baked into your images, how workloads are isolated from each other, and whether a foothold in one pod reaches the rest of the cluster.
- Vendor consoles The SaaS accounts that can change production, from source control and CDN to hosting and identity. Who holds admin, and what a single one of those logins is worth.
Covers AWS, GCP, and Azure alongside the platforms built on top of them: GitHub, GitLab, Bitbucket, CI pipelines, Docker, Kubernetes, Terraform and other infrastructure-as-code, Cloudflare, Vercel, Okta, and other third-party services. Scope an entire account, or narrow it to the services that matter most, such as IAM and key management.
The breach was at a cloud database provider. Nothing onchain had to fail for the funds to move. Mixin · $200M (read the incident write-up)
Scoped by the cloud accounts and platforms in play.
Audits & Pentests
Other engagements
Start now