Not how it is drawn in the architecture diagram — how it is configured on a Tuesday afternoon. A read-only role, a fixed window, and an assessment scored across security, reliability, operations, cost, performance and governance. You get the material risks in priority order, each one citing evidence you can open yourself, and an explicit list of what we could not check and why.
Start with visibility and readiness
Continuous improvement and confidence
The difference between "I think our IAM is probably fine" and knowing, with the evidence attached, is the entire product. Most teams are wrong in both directions — relaxed about something that matters, anxious about something that does not.
A scanner returns four hundred findings sorted by its own severity rubric. This returns the ones that matter to your business, in the order a senior engineer would actually fix them, with the reasoning written down.
Every material finding says what it means for you, not just which control it violates. What breaks, who is affected, what it would take to fix, and what happens if you leave it another two quarters.
The output is written to survive being sent to a board, an insurer or a customer's security team without translation. It is also written so your own engineers can act on it without us.
Everything below lands in your repository and your accounts. If you stop working with us, none of it stops working.
The exclusions are the same size as the inclusions on purpose.
Same read-only role, same collectors, same evidence set. What changes is the question the findings are ordered against — so running both costs one access grant and one window, not two.
Load paths and their limits, resilience to a component failing, and recovery: whether a restore has ever actually been performed, how long it took, and what was lost. The mode most teams start in.
The same estate read against the SOC 2 and ISO 27001 controls that are satisfied by infrastructure — access, logging, retention, encryption, change control — naming the ones it does not currently meet and what closing each would take. A SOC 2 report is issued by an independent auditor, and ISO 27001 certification by an accredited body; this is the engineering work in front of either.
Six pillars, assessed against production practice, scored, then ordered by what a senior engineer would fix first rather than by a tool's default severity.
Specimen — illustrative, not a customer's data
The company, the scores and every finding here are invented for illustration. A real EdgeReady assessment scores your own environment, evidence and all.
Pillar
Top risks, by severity
The complete deliverable, unabridged: maturity across six pillars, fourteen worked findings with the evidence behind each, a cost baseline and a 30/60/90 plan. The subject company is invented; the structure and the rigour are exactly what you would receive.
Name and work email, then it lands in your inbox. Two fields, and we do not run a nurture sequence off them.
All eleven anonymised engagements
No. EdgeReady is read-only from start to finish. The access you grant reads configuration metadata in the accounts you name; no step in the assessment writes.
No. AWS is the deepest specialism, which is why the questionnaire on this site is AWS-specific. The assessment is not — the same six pillars are assessed in Azure and GCP.
No. Compliance mode names the controls your infrastructure currently fails and what closing each would take — the engineering work in front of an audit. The SOC 2 report comes from an independent auditor, ISO 27001 certification from an accredited body.
No. Where a tool found something we name it and check the finding first. The ordering is what a senior engineer would fix first, not a product’s severity rubric.
They are written down, in an explicit completeness statement: which domains were fully assessed, which were partial, and what a missing permission stopped us seeing.
No. The EdgeReady fee comes off whatever you book with us within 30 days.
Twenty minutes on a call will tell you, and will tell us. If a different product fits better — or what you need is not on this list at all — say so. Nothing is priced on the call; a written scope follows within 24 hours.
