What is a threat review? A cloud and identity checklist
Understand what a threat review can reveal, which evidence to prepare and how BlackPing’s read-only review differs from a penetration test.
A threat review examines available security evidence for suspicious activity and exposure. The term is not a single standardized engagement: agree on the systems, time window, access and deliverables before a review begins.
BlackPing’s free threat review uses 14 days of read-only access to your cloud and identity stack and provides a written report of observed activity. It is a starting point for understanding your environment, not a guarantee that every threat will be found.
Threat review versus penetration test
A threat review focuses on evidence that can be observed in the agreed environment. A penetration test actively tests a defined scope for exploitable weaknesses under explicit authorization. Neither replaces the other, and a clean review does not certify that a system is secure.
A formal threat and risk assessment is also a different scope: it evaluates assets, threats, safeguards and risk treatment. BlackPing’s read-only activity review should not be treated as a formal threat and risk assessment.
If you need active testing, compliance certification or urgent incident response, say so before selecting an engagement. Do not assume those services are included in a read-only review.
Prepare the scope before sharing access
- List the systems. Identify cloud accounts, identity providers and important applications. Name a technical owner for each.
- State the concern. Describe suspicious logins, unexpected permission changes, public resources or a logging gap. Include dates and timezones without sharing passwords or tokens.
- Confirm the evidence. Check which sign-in and audit events are collected, how long they are retained and which actions are not logged. Missing evidence limits conclusions.
- Agree on access. Use the least privilege needed for the review, document the permissions and define when access will be removed. Do not grant write access for a read-only engagement.
Questions worth asking about cloud and identity activity
Are privileged accounts changing permissions unexpectedly? Do new devices or unusual sign-ins line up with MFA changes? Have applications received broad OAuth permissions? Are credentials being created without a clear owner? Is logging enabled for the resources that matter?
These are investigation questions, not automatic proof of compromise. Approved deployments, travel and normal administration can produce unusual events. Keep the original records and check the surrounding activity before reaching a conclusion.
Turn findings into decisions
For each finding, ask what was observed, which records support it, what remains uncertain and who owns the next decision. Separate urgent concerns from longer-term improvements. Agree on the follow-up rather than treating receipt of a report as completion of the work.
A BlackPing review does not authorize containment. Review access stays read-only; any later containment requires human approval. If you suspect an active compromise, use your incident-response process rather than waiting for a scheduled review.
Book a BlackPing threat review
Provide your name, company, work email, organization size and cloud context in the booking form. You can describe the concern without sending credentials. Submitting the form requests a review; an appointment time has not been confirmed until arrangements are agreed.