Cloud security, built and run by engineers
We review your Google Cloud and Workspace environments, deploy the tooling that watches them, and fix what it finds.
Almost every organisation we meet has had a security assessment. Some have had three. The findings sit in a spreadsheet, the highest-severity items are still open a year later, and the next assessment finds them again.
The gap isn’t knowing. It’s capacity. Nobody on the platform team has a spare week to rewrite IAM bindings or unpick a service account that eleven workloads depend on.
We do both halves. We find the problem and we fix it, in your Terraform, with your team watching.
Aviato is a Google Cloud Premier Partner and an Elite Wiz Partner.
What a Cloud Security Review covers
A two-week review of your Google Cloud organisation, with findings ranked by what an attacker would actually use and a fix list we can deliver for you.
- IAM and least privilege. Role bindings, service account sprawl, and the accounts with more access than anyone remembers granting.
- VPC boundaries and data exfiltration. Network exposure, egress paths, and whether VPC Service Controls would actually hold.
- Encryption and key sovereignty. Customer-managed keys, where key material lives, and who can use it.
- Regulatory mapping. Findings mapped to APRA CPS 234, the ACSC Essential Eight, SOC 2 or ISO 27001, depending on what you answer to.
Which one do you need?
- Want to see what is exposed on your perimeter right now? Request a Free AI Pen Test (requires a written approval email from your work address).
- Never had a cloud review? Start with a Cloud Security Review. It tells you where you stand in two weeks and costs less than the tooling.
- Want it watched continuously? Start with Wiz: full deployment, attack path analysis and fixes raised as Terraform pull requests.
- Too many alerts and nobody reading them? That’s Google SecOps if you want to run it, or our Managed Agentic SOC if you want us to.
- Mostly on Workspace? Do the Workspace Security Review first: Context-Aware Access, data loss prevention and third-party app access.
- Not sure? Ask us. Thirty minutes is usually enough to tell.
Related work
- Confirm Control: digitised safety and compliance audits on Firestore and Cloud Run.
- Our Vanta partnership: continuous evidence collection for SOC 2, ISO 27001 and APRA CPS 234.
- Financial services: hardened cloud foundations for banks, super funds and fintechs.
- Deep dive into GCP security: threat modelling, customer-managed keys and VPC Service Controls.
- Workspace Studio and Context-Aware Access: resolving zero-trust policy conflicts.
Why us
Focused stack. We only do Google Cloud, Google Workspace and Wiz. No AWS, no Azure, no long tail of tools we have read the datasheet for.
Ex-Google leadership. The team is led by people who worked inside the products they now secure.
No lock-in. Everything we deliver is documented and handed over, and we will tell you when the answer is a setting change rather than a project.
Key Deliverables
Explore Security solutions
Dedicated engineering playbooks for mainframe and AIX migrations, monolith decomposition, API gateways and cloud-native builds.
Free AI Pen Test
Send written approval from your work email and we will run a free AI pen test against your external perimeter and send you the verified findings.
Wiz Deployment & Remediation
Agentless Wiz onboarding across Google Cloud, AWS and Kubernetes, paired with hands-on Terraform pull requests to close toxic attack paths.
Google SecOps (Chronicle)
Ingest cloud, Workspace, identity and endpoint telemetry into Google SecOps with custom YARA-L detections and automated SOAR playbooks.
Google Workspace Security Review
Harden Gmail, Drive, OAuth app permissions, Context-Aware Access and DLP rules against phishing and session hijacking.
Unblock AI Workloads (Wiz + SecOps)
Combine Wiz AI posture mapping with Google SecOps runtime detections so your risk committee can approve production AI agents.
Security case studies
Named clients and the results they agreed to publish.
Confirm Control: Real-Time Field Risk Governance & Compliance
Architected an offline-first Flutter mobile application with serverless Google Cloud Firestore backend to digitize field hazard logging and APRA-compliant risk governance.
Cross-Cloud AWS to Google Cloud Modernization for Fitness Platform Hapana
Migrated millions of active workouts, global member billing, and IoT facility door access controllers from AWS to a secure Google Cloud Run landing zone with zero cutover downtime.
1,000-Core On-Demand Supercomputer for Global Engineering Leader
Engineered an elastic Slurm HPC cluster on Google Cloud with Scale-to-Zero automation, delivering 10x faster simulation turnaround with zero idle compute waste.
Security: questions we get asked
How does the Free AI Pen Test work, and why do I need to send an email?
We run a free external AI pen test to find and verify real attack paths on your public perimeter without dumping 400 pages of scanner noise on your desk. Because active probing touches live systems, we require a written email from your work address approving the test and accepting the minor operational risk before we start.
What do we get at the end of a security review?
A triaged list of the findings that actually create attack paths, and the Terraform to fix them. Not a 100-page PDF of alerts.
How is this different from just buying Wiz?
Wiz tells you a container is publicly reachable, running a critical CVE, and holding a service account that can move laterally. Fixing that means changing Terraform, IAM and a build pipeline. We hold Elite partner status with Wiz and Premier status with Google Cloud, so the finding and the fix are handled by the same engineers.
Do you cover APRA CPS 234?
Yes. We deliver against CPS 234 for regulated clients, and we use Wiz and Google SecOps to produce the evidence continuously rather than assembling it before an audit.
Can you help us get AI workloads approved by our risk team?
That is a specific engagement we run using Wiz and Google SecOps together. The blocker is usually not the model, it is that nobody can show the risk committee what the agent can reach and what happens when it misbehaves.
Do you do the remediation, or just the report?
The remediation. We fix the misconfigurations in Terraform and automate the detection pipelines. The report on its own does not reduce your risk.
Talk to an architect who has done this before.
Bring your current setup and the outcome you need. You will get a view on the approach, the risks and roughly what it costs.
Straight to a senior GCP architect. No SDR, no slide deck.
Not ready to talk? See how we migrated Hapana off AWS →
Or call +61 2 8359 9507 · Hello@aviato.consulting