Cloud Penetration Testing in Australia: AWS, Azure and Microsoft 365 Guide

Cloud penetration testing is a human-led, authorised attack on your AWS, Azure, Google Cloud or Microsoft 365 environment to prove how someone could abuse identities, permissions, exposed services or misconfigurations to reach your data. For Australian businesses, the cloud provider secures the platform, but you remain responsible for how your tenant is configured and who can access it. A cloud pentest tests that half of the shared responsibility model with evidence, not assumptions.

This guide covers what cloud penetration testing includes, how it differs from a configuration review or automated scan, what AWS, Microsoft and Google allow, how Australian obligations (Privacy Act / APP 11, Essential Eight, APRA CPS 234 and CPS 230) point toward it, and what it costs on published Aussie Pentest tiers. It pairs with our guides on external vs internal penetration testing, API penetration testing and how to prepare for a penetration test.

What is cloud penetration testing?

Cloud penetration testing is a scoped, authorised security assessment that attacks the parts of a cloud environment you control: identities, roles, network exposure, storage, workloads and the management plane. The goal is to show what an attacker could actually reach, not to list every setting that differs from a benchmark.

Most Australian SMBs run critical systems in the cloud even if they don't think of themselves as "cloud companies": email and files in Microsoft 365, apps in Azure or AWS, backups in object storage, and contractors or MSPs holding admin roles. Each is an attack path.

What it is not

▸Not a test of the cloud provider itself. You test your own tenant, subscriptions, accounts and projects. Testing the provider's shared infrastructure is off-limits under every major provider's rules.
▸Not a compliance certificate. A pentest report is evidence that supports your risk decisions, insurer questionnaires and customer due diligence. It does not certify you against any framework.
▸Not a configuration checklist alone. A posture scan tells you a setting is off. A pentest proves whether that setting, combined with others, lets someone read payroll files or take over a global admin account.

Why do Australian businesses need cloud penetration testing?

Because cloud security is a shared responsibility, and the part you own (identity, configuration, access and data handling) is where most cloud compromises start. ASD's ACSC is direct about this: organisations are ultimately responsible for protecting their data, even though risk mitigation is shared with the cloud service provider.

ASD's Cloud computing security for tenants guidance says mitigating cloud risk is shared between the tenant and the provider, but that "organisations are ultimately responsible for protecting their data and ensuring its confidentiality, integrity and availability." Its cloud assessment and authorisation guidance adds that the cloud consumer must plan, design and configure its services to achieve its security baseline, then monitor for drift.

The cost of getting it wrong

ASD's Annual Cyber Threat Report 2024–25 found:

▸ASD's ACSC received over 84,700 cybercrime reports in FY2024–25, an average of one every 6 minutes.
▸It responded to over 1,200 cyber security incidents, an 11% increase on the previous year.
▸The average self-reported cost of cybercrime per report was $56,600 for small businesses (up 14%), $97,200 for medium businesses (up 55%) and $202,700 for large businesses (up 219%).

Privacy exposure is climbing too. The OAIC received 1,205 data breach notifications in calendar 2025, the highest since the Notifiable Data Breaches scheme began in 2018 and an 8% increase on 2024. Malicious or criminal activity caused 716 of them.

These figures are not cloud-only. But when most of a business's data sits in Microsoft 365, Azure or AWS, the cloud tenant is where that data gets stolen from.

Privacy Act and APP 11

If your organisation is covered by the Privacy Act, APP 11 requires reasonable steps to protect personal information. Since the Privacy and Other Legislation Amendment Act 2024, APP 11.3 states that reasonable steps include technical and organisational measures. The OAIC's APP 11 guidelines list access controls and encryption among those technical measures, proportionate to the risk.

Note that many businesses with annual turnover of $3 million or less are exempt, but exceptions apply, including small businesses that provide a health service and hold health information. Check your position rather than assuming.

APRA CPS 234 and CPS 230

CPS 234 requires APRA-regulated entities to test the effectiveness of their information security controls through a systematic testing program, using appropriately skilled and functionally independent specialists. CPS 230, in force since 1 July 2025, requires regulated entities to identify and manage material service providers, which can include cloud arrangements that support critical operations. If you are a SaaS or managed service supplier to a bank, insurer or super fund, expect their questionnaires to ask how your cloud environment was tested and when.

What does a cloud penetration test cover?

A credible cloud pentest covers identity and access, the management plane, network exposure, storage and data, workloads, logging and the integrations that connect them. The depth depends on the platforms in scope, how many accounts or subscriptions you run, and whether testers start with zero access or an assumed-breach foothold.

Identity and access (usually the biggest risk)

▸Over-privileged users, groups, service principals and roles.
▸Admin roles held by people or vendors who no longer need them.
▸Gaps in multi-factor authentication, conditional access or legacy sign-in methods.
▸Paths from a standard user to a privileged role through role assignments, group ownership or app permissions.
▸Guest and external tenant access in Microsoft 365 and Entra ID.

Management plane and configuration

▸Who can change security settings, logging, backups or network rules.
▸Policy gaps in AWS IAM, Azure RBAC, management groups and Google Cloud IAM.
▸Secrets stored in plain text in automation, pipelines, app settings or templates.

Network exposure

▸Internet-facing virtual machines, databases, management ports and remote access services.
▸Security groups and network rules that allow broader access than intended.
▸Connectivity between cloud and on-premises networks (VPNs, peering, hybrid identity).

Storage and data

▸Publicly accessible buckets, blobs or file shares.
▸Over-shared SharePoint and OneDrive content.
▸Backup storage that a compromised account could read, modify or delete.

Workloads and applications

▸Cloud-hosted servers, containers, serverless functions and their attached identities.
▸Web apps and APIs running in the tenant (often scoped alongside a web application or API test).

Logging and detection

▸Whether audit logs are enabled, retained and protected from tampering.
▸Whether testing activity was noticed by your team or MSP.

Microsoft 365: the cloud environment most SMBs forget

Many Australian SMBs say "we don't really use the cloud" while running their entire business on Microsoft 365. Email, Teams, SharePoint and Entra ID together hold contracts, invoices, HR files and client data. A Microsoft 365 security review looks at identity, conditional access, admin roles, external sharing, mail flow and audit logging. ASD's Blueprint for Secure Cloud is a useful reference: it is primarily built for government, but ASD notes private sector organisations may also find it useful.

How is a cloud pentest different from a config review or automated scan?

An automated scan checks known issues on exposed assets, a configuration review compares settings to a baseline, and a cloud pentest proves which weaknesses chain into real access to your data. Each has a place; they answer different questions.

Approach	What it answers	Best for	Limits
Automated security assessment	What known vulnerabilities are visible on internet-facing targets?	Fast, low-cost baseline on web apps and exposed hosts	Does not test your cloud identity model or management plane
Configuration / posture review	Which settings differ from a recommended baseline?	Hygiene, drift and benchmark gaps	Rarely proves impact or attack chains
Cloud penetration test	What could an attacker actually reach, and how?	Evidence for insurers, customers, boards and regulators	Point-in-time; costs more; needs careful scoping

Aussie Pentest's automated security assessment is analyst-reviewed and starts at $80, but it is not a penetration test, and its standard tiers cover internet-facing assets. For a deeper explanation of that line, see vulnerability assessment vs penetration testing.

Do you need permission from AWS, Microsoft or Google to pentest?

Generally no pre-approval is needed to test your own resources on the major platforms, but each provider has rules you must follow, and some activities still need approval. Your provider's terms, plus written authorisation from the asset owner, define what testers can do.

▸AWS: customers can test their own AWS infrastructure without prior approval for a listed set of permitted services. Activities such as command-and-control testing and denial-of-service simulations need prior approval, and some activities are prohibited.
▸Microsoft Azure: Microsoft has not required pre-approval since 15 June 2017, but testing must comply with the Microsoft Cloud Unified Penetration Testing Rules of Engagement. Microsoft notes its abuse detection may flag or interrupt legitimate testing, so keep authorisation documents handy.
▸Google Cloud: Google's Cloud Security FAQ says you do not need to contact Google before testing your own projects, provided you comply with its Acceptable Use Policy and terms.

Whatever the platform, the scope should name the exact accounts, subscriptions, tenants or projects in scope. If an MSP or software vendor owns part of the environment, get their written agreement before testing starts.

How does cloud testing fit with the Essential Eight?

The Essential Eight and cloud penetration testing answer different questions: E8 measures maturity against eight baseline mitigation strategies, while a cloud pentest proves whether your tenant can be abused. Many controls overlap, especially multi-factor authentication, restricting administrative privileges and regular backups.

For example, the Essential Eight maturity model requires MFA for users of online services that process, store or communicate sensitive data from Maturity Level One, and phishing-resistant MFA for online services at Maturity Level Two. A cloud pentest checks whether that MFA actually covers every sign-in path, every admin role and every service account in practice.

ASD also notes the Essential Eight is a minimum set of preventative measures and that organisations need additional measures where their environment warrants it. Cloud identity and configuration risk is a common example. If you need a maturity score, an Essential Eight assessment is the right tool. If you need to know what an attacker could do inside your tenant, that is a pentest. For more on the framework, see Essential Eight Maturity Level 1 vs 2.

How much does cloud penetration testing cost in Australia?

Aussie Pentest does not publish a separate cloud-only price; cloud environments are scoped into fixed-fee, human-led engagements that start from $5,000, $12,000 or $20,000 + GST, depending on the surfaces in scope. The final quote is fixed in writing after a scoping call.

Published tiers on the Aussie Pentest pricing page:

Option	Price (AUD)	What it is
Automated security assessment	$80 / $200 / $500 / $2,000	Analyst-reviewed assessment of internet-facing targets; not a pentest
Penetration test: Basic	From $5,000 + GST	External network test, up to 25 IPs
Penetration test: Standard	From $12,000 + GST	External and internal, up to 50 IPs and 2–3 web apps
Penetration test: Advanced	From $20,000 + GST	Full-scale: external and internal, web apps and APIs, social engineering
Essential Eight assessment	$4,950 + GST	Fixed fee for environments up to 50 seats
vCISO retainer	$2,500–$6,500/month	Ongoing advisory; Growth and Executive include a light technical check each quarter

What changes the price of a cloud test

▸Number of platforms (Microsoft 365 only, or M365 plus Azure and AWS).
▸Number of accounts, subscriptions or projects.
▸Number of identities, roles and privileged users to map.
▸Whether web apps and APIs in the tenant are in scope.
▸Black-box (zero access) versus grey-box or assumed-breach testing with a standard user account. Our guide to black, grey and white box testing explains the trade-offs.
▸Hybrid links back to on-premises Active Directory.

Engagements average 5–10 business days from kickoff to delivered report, depending on scope.

What should you prepare before a cloud penetration test?

Prepare a clear asset list, written authorisation from every owner, test accounts for the roles in scope, and a contact who can pause testing if something unexpected happens. Good preparation saves testing days and avoids surprises.

List the environments: tenants, subscriptions, AWS accounts and Google Cloud projects, with production and non-production marked.
Confirm ownership: if an MSP, developer or SaaS vendor manages any part, get their written agreement.
Choose the starting point: zero access, a standard user account, or a compromised-device scenario.
Create test accounts with the roles your real users have. Never share live customer credentials in chat or email.
Agree rules of engagement: testing windows, excluded systems, no destructive actions, and an emergency contact.
Tell your MSP or SOC if you want to avoid false alarms, or keep it quiet if detection is part of the test.
Plan the retest: budget time to fix findings and confirm the fixes hold.

What should a cloud pentest report include?

An executive summary a non-technical owner can read, attack paths shown step by step with proof-of-concept evidence, findings ranked by how an attacker would exploit them, and plain-English fixes for each platform. Add framework mapping (Essential Eight, ISO 27001, SOC 2) and retest confirmation once fixes land. If the report is mostly a posture-tool export, you bought a configuration scan.

Aussie Pentest reproduces every critical finding with proof-of-concept evidence before it goes in the report. If we can't prove it, it doesn't ship. See what to expect from a penetration testing report for the full structure.

Frequently asked questions

Is Microsoft 365 included in a cloud penetration test?

It can be, and for most SMBs it should be. Microsoft 365 and Entra ID hold identity, email and files, so they are often the highest-value target. Make sure the scope names Microsoft 365 explicitly rather than assuming "cloud" means Azure servers only.

How often should we test our cloud environment?

At least annually, and after major changes such as a migration, new tenant, merger or big identity redesign. Configuration drifts quickly in the cloud, so pair point-in-time tests with ongoing monitoring. Our guide on how often to pentest goes deeper.

Can our MSP do our cloud penetration test?

They can, but they would be testing an environment they built or manage. Independent testing gives you, your board and your insurer a more objective view. Validate what your MSP built rather than replacing them.

Does a cloud pentest make us compliant?

No single test makes you compliant. A report supports evidence for APP 11, CPS 234, insurer questionnaires and customer due diligence, but acceptance is up to the regulator, insurer or customer reviewing it.

Do we need a cloud pentest if we already passed an Essential Eight assessment?

Possibly. An Essential Eight assessment scores maturity against eight strategies. It does not attempt every attack path through your cloud identities, roles and integrations. Many organisations do both.

The bottom line

If your Australian business runs on Microsoft 365, Azure, AWS or Google Cloud, the provider secures the platform, but your configuration, identities and data are yours to protect. A human-led cloud penetration test proves what an attacker could reach through the parts you own, gives you evidence for insurers, customers and regulators, and tells your IT team or MSP exactly what to fix first. Scope it explicitly, include Microsoft 365, prefer an assumed-breach or grey-box starting point, and retest after the fixes land.

Ready to scope a cloud test? Explore our penetration testing services, check the pricing page, or book a 1-on-1 scoping call with the Aussie Pentest team.

Sources

This article is general information only, not legal, regulatory or compliance advice. Statistics and regulatory references are current as of October 2026. Check your own obligations with a qualified adviser.