Your Cloud Assets are Probably Not as Secure as You Think They Are

Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.

Compares cloud penetration testing across AWS and Azure, explaining the shared responsibility model and why platform-specific nuances matter for methodology and cloud security maturity.

Karl Fosaaen explores anonymous enumeration of Azure blob storage, explaining container access policies and releasing tooling to find publicly exposed blobs holding configs, backups, and credentials.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

Discover how NetSPI's Azure & AWS Configuration Reviews provide continuous visibility, risk identification, and actionable insights to secure your cloud environments.

Azure pentesting research on Logic Apps: a Reader-role user can dump credentials embedded in Logic App definitions, while a Contributor can identify and abuse API Connection hijack scenarios.