Fixed-price security reviews for teams running production workloads on AWS EKS. Find out where you stand, what to fix first, and how to prove it to auditors, customers and insurers.
| CIS 5.1.5 | Default service accounts not actively used | PASS |
| CIS 4.2.6 | Containers run with allowPrivilegeEscalation | FAIL |
| IAM-03 | Node role scoped to least privilege | PASS |
| NET-01 | Namespaces missing default-deny network policy | FAIL |
| SEC-02 | Secrets encrypted with customer-managed KMS key | PARTIAL |
| CI-04 | Images scanned before deploy | PASS |
Enterprise security tooling can cost more than your cloud bill, and a pentest tells you about your application, not your cluster, your IAM or your pipeline.
Meanwhile auditors, NHS and enterprise customers, and cyber insurers are all asking the same question: can you show that your Kubernetes environment is secure?
ClusterSure answers that in two weeks, at a fixed price agreed before work starts.
Pick the area closest to your problem. Each card lists what the work usually covers; your proposal sets the actual scope.
Where do we actually stand today?
Your clusters and AWS account measured control by control, with findings ranked by real-world risk.
Who can reach production, and should they?
Access paths traced from AWS identity down to Kubernetes permissions.
How do we fix it so it stays fixed?
Findings turned into code your team owns, with guardrails that stop regressions.
What could reach production without anyone checking?
Security checks built into everyday delivery, with clear build gates.
Can you hand an auditor evidence in an afternoon?
Evidence collected automatically and mapped to the framework outcomes you report against.
Starting fresh, or restructuring accounts?
An AWS and EKS foundation designed to pass an audit from day one.
If yours is different, pick the closest one and tell us more on the call.
No 200-page PDF that nobody reads. Every finding comes with the evidence, the risk and the fix.
Scored findings reportEach control marked pass, fail or partial, benchmarked against CIS and mapped to the frameworks you report on.
Ranked remediation backlogOrdered by risk, with effort estimates, ready to import into Jira or GitHub Issues.
Fix configurationsConcrete policy, Terraform and manifest changes for each failing control.
Walkthrough callWe go through the results with your team and agree what to tackle first.
NET-01 · Default-deny network policyHigh6 of 9 application namespaces have no NetworkPolicy. Any pod can reach any other pod, including the payments service.
One compromised workload can move laterally across the cluster. Auditors treat this as a segmentation gap.
# apply per namespace, then allow known flows
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: payments
spec:
podSelector: {}
policyTypes: [Ingress, Egress]
CIS Kubernetes 5.3.2 · ISO 27001:2022 A.8.22
Illustrative example of the report format, not client data.
We confirm clusters, accounts and the frameworks you care about, then send a fixed-price proposal.
You create a scoped, read-only IAM role from a template we provide. Nothing is installed in your clusters without agreement.
Automated scans plus manual review of IAM, RBAC, workloads, networking and your delivery pipeline.
Findings scored, ranked and mapped, with fix configurations for each failing control.
We go through the results with your engineers and agree priorities. Access is then revoked.
A remediation sprint, a retest, or ongoing assurance. Entirely your choice.
ClusterSure is run by an engineer who secures production EKS environments every day, with eight years across cloud infrastructure, DevSecOps and compliance-driven environments, including regulated industries.
You work directly with the person doing the assessment. No hand-off to a junior team, no account manager in the middle.
Every engagement begins with a 30-minute call. You then get a written proposal with deliverables, timeline, responsibilities and a fixed price. Nothing starts until you approve it.
Share your clusters, accounts and any audit or customer deadline. A short form prepares the email for you.
Discuss your environmentOnline booking is not available yet. Email a few times that suit you and we will reply within one working day to confirm.
Book a callBased in the United Kingdom. Every engagement starts read-only, under your NDA if you need one.
A read-only IAM role in each AWS account in scope, created from a Terraform or CloudFormation template we provide, plus read-only cluster access mapped to that role. We never need write access to assess, and access is revoked at the end of the engagement.
Not by default. Most checks run against the Kubernetes and AWS APIs from outside the cluster. If a node-level check such as kube-bench is useful, we agree it with you first and remove it afterwards.
Yes. Findings can be mapped to the NHS Data Security and Protection Toolkit, Cyber Essentials and ISO 27001, which together cover most of what NHS customers ask health tech suppliers for. Tell us which frameworks matter on the scoping call.
By scope: the number of clusters and AWS accounts, and whether pipeline review is included. You get a fixed price in writing before any work starts, and it does not change unless you change the scope.
Scan output and evidence are stored encrypted, kept only for the engagement and an agreed retention period, then deleted. We are happy to sign your NDA or work under your data processing terms.
The posture review is built for EKS, but IAM, pipeline security and evidence automation apply to any AWS estate. Ask on the call and we will tell you plainly whether it is a good fit.
Yes. A remediation sprint delivers the fixes as pull requests to your repositories, so your team reviews and owns every change.