Organization and IAM
Folders, projects, organization policies, Cloud Identity, groups, service accounts, workload identity federation and privileged paths.
Google Cloud security
Make the boundary clear from org to workload.
We help teams bring order to folders, projects, service accounts and data paths—then harden GKE and managed services without breaking how developers ship.
01 / GCP scope
Use the hierarchy instead of fighting it.
Google Cloud security starts above the project. We review how policy, identity, network and data controls inherit—and where exceptions quietly bypass that design.
Networks and perimeters
Shared VPC, firewall policy, private access, egress, load balancing, Cloud Armor and VPC Service Controls.
GKE and workloads
Cluster modes, node and workload identity, admission policy, secrets, image provenance and runtime boundaries.
Data and detection
Cloud Storage, BigQuery, KMS, audit logs, Security Command Center, alert routes and incident access.
02 / Method
Follow inheritance, then follow the data.
We use the Google Cloud Architecture Framework as a reference while testing the places where your organization design and workload reality diverge.
Map
Document resource hierarchy, principals, networks, high-value data and control inheritance.
Trace
Validate risky access paths, external exposure, service-account use and data movement.
Repair
Apply guardrails and workload changes through Terraform or controlled configuration, then retest.
03 / Outputs
- 01Organization and project security map
- 02IAM and service-account remediation
- 03Network and data-boundary improvements
- 04GKE hardening changes and operating notes
- 05Detection coverage and prioritised backlog
Bring us the GCP project that became a platform.
We will map what it inherited—and what it did not.
Review Google Cloud →