Strand Cloud Compromise Assessments

Strand Cloud Compromise Assessments is a service that reviews cloud tenants of UK telecommunications providers on a daily basis to determine whether they have been compromised. It examines logs across Microsoft 365, Microsoft Entra ID, Microsoft Azure, AWS and Google Workspace to identify signs of attacker activity, including suspicious privileged sign-ins, unexplained changes to mailboxes or automation identities, and high-risk application-consent events. Each daily run produces a posture assessment that scores cloud configuration across domains such as privileged access, identity and authentication, applications and workload access, data sharing and storage, and audit log coverage. It also produces a compromise assessment that reports evidence reviewed over a rolling period, stating the scope, review window and any coverage gaps. If evidence of compromise is identified, Strand extends the same case into a full investigation covering cloud, identity, endpoint and server evidence to establish root cause, lateral movement, data exfiltration and impact, producing executive, technical and evidence reports. The product is positioned to help UK telecoms providers meet requirements of the Telecommunications Security Code of Practice 2026, including periodic threat hunting (M16.02, M16.03) and root-cause identification after incidents (M5.05). It does not replace existing monitoring or log retention systems but works alongside them. Remediation output identifies affected settings, accounts or applications, states the associated risk, and recommends specific configuration changes, grouped by urgency (immediate review, scheduled remediation, planned hardening). Data is UK-hosted and no changes are made to the customer environment during assessment.