Ten AWS regions, one phishing campaign, no breaches

Network perimeter fully exposed: security groups allowed unrestricted access to all services and ports across the global infrastructure.

Audit trail blind spots: data-plane operations such as file access and serverless function invocations were not captured in activity logs.

Administrative server access (SSH) open to the internet without IP restriction, across multiple regions.

Data storage volumes not encrypted by default, with trading and operational data potentially stored in plain text.

Cloud configuration changes not tracked, so unauthorized infrastructure modifications could go undetected.

Backup snapshots left unencrypted, exposing data recovery points if storage is compromised.

Red team: employee susceptibility to credential phishing was tested, and MFA integrity was validated under a live simulated attack.

Regulated tech companies needing both cloud infrastructure review and employee phishing validation.

Organizations with globally distributed AWS infrastructure.

Firms in VARA, FCA, or MAS regulated environments.

Why review infrastructure and people in the same engagement?

A globally distributed, regulated firm faces both risks at once. Testing them together produces one coherent picture of exposure instead of two disconnected reports.

Why is missing data-plane logging a significant finding on its own?

Without it, a successful intrusion into storage or serverless functions may leave no trace, which means detection and incident response depend entirely on controls that were never tested until this audit.

What does "MFA held under all test scenarios" mean in practice?

Every simulated phishing attempt aimed at obtaining credentials or session access was defeated by multi-factor authentication, even where a credential itself may have been at risk.

How does this map to VARA or similar regulatory expectations?

Regulators in these regimes increasingly expect evidence of both technical infrastructure controls and human-layer resilience testing, which is exactly what the two tracks of this engagement produced.