Book a diagnostic

Cloud cost, uptime and security work for engineering teams

Verne cuts cloud spend you do not need, makes outages rarer and shorter, and prepares the evidence auditors and customers ask for. The first week is a fixed set of ten checks on cost, backups, access and code. We help your team meet the duties it answers to, such as GDPR, national data-protection laws and the EU AI Act.

Book a reviewTry the example below

The ten checks we run in week one

Tick each check as you read it. Every one ends in a written finding, ranked by what it costs you or what it risks.

Cost
Reliability
Security
Evidence

The estate below is drawn, not scanned. Findings name what each check looks for.

0 of 10 checks run.

    What the practice covers

    • Cloud cost reduction

      Spend tagged to owners and workloads, idle resources removed, commitments matched to steady use.

    • Cloud migration

      Moves to AWS, Azure or Google Cloud planned service by service, with a rollback for each step.

    • DevOps and reliability

      Pipelines, monitoring and runbooks, so a failure at night has a known first step.

    • Security testing and hardening

      Threat models, code and dependency scanning, access reviews, and fixes made with your engineers.

    • Compliance evidence

      Controls mapped to the regime you must meet, with the records an auditor will ask to see.

    For your engineers

    Stack

    Terraform or Pulumi for infrastructure as code; GitHub Actions or GitLab CI; OpenTelemetry for logs, metrics and traces; AWS, Azure or Google Cloud.

    Cost

    Cost-allocation tags, rightsizing from 14 days of utilisation data, commitment coverage reports, and budget alerts per team.

    Security

    AI features threat-modelled against the OWASP Top 10 for LLM Applications and MITRE ATLAS. Findings mapped to the six NIST CSF 2.0 functions. Secret, dependency, container and infrastructure scanning tied to a severity and an owner.

    Agents

    Tool rules enforced in a gateway outside the model, scoped identities per agent, and human approval for consequential actions.

    Evidence for your auditor

    We help your team meet the regime it answers to: we map your controls to it, close the gaps with your engineers, and set up the records your auditor or customer will ask for. The evidence stays in your systems.

    Under the EU AI Act, duties for high-risk AI systems now apply from 2 December 2027 for stand-alone systems and from 2 August 2028 for systems embedded in products.

    A final penetration test cannot substitute for a secure delivery process. No scanner or prompt filter proves the absence of vulnerabilities. Where a regime calls for an independent assessor, we prepare your team and the evidence for that review.

    Source: European Parliament, Legislative Train: Digital omnibus on AI

    Last reviewed

    A cloud bill that grew 40% while traffic stayed flat

    A Sydney marketplace's cloud bill had climbed every month for a year while its traffic barely moved. Each team suspected another team's service, and nobody had time to look.

    In the first week, the review also found a storage bucket of supplier contracts that anyone with the link could read.

    1. Read the bill before cuttingEngineers tagged every resource to an owner and read twelve months of cost data before switching anything off.
    2. Close the real leaksStorage traffic was crossing a NAT gateway at a per-gigabyte charge, so a free gateway endpoint now carries it. Debug logging ran at full volume in production and now samples. Old snapshots had no expiry and now do.
    3. Lock the bucket the same dayThe contracts bucket was closed within the hour, and its access logs were kept to show who had read it.
    4. Every change reviewedEach change went through infrastructure code, reviewed by an engineer and approved by the client's platform lead, with a rollback ready.
    infra/network.tf
    resource "aws_vpc_endpoint" "s3" {  vpc_id            = aws_vpc.main.id  service_name      = "com.amazonaws.ap-southeast-2.s3"  vpc_endpoint_type = "Gateway"}resource "aws_s3_bucket_public_access_block" "contracts" {  bucket                  = aws_s3_bucket.contracts.id  restrict_public_buckets = true}
    1. Cost trace61% of NAT data-processing charges come from S3 traffic leaving the private subnets.
    2. EngineerAdded an S3 gateway endpoint, which carries no data charge, and blocked public access on the contracts bucket.
    3. Your platform leadApproved and applied with the rollback plan open.

    Sectors

    Questions about cloud and security

    Can you help us prepare for SOC 2 or ISO 27001?

    Yes. We map your controls to the standard, close the gaps with your engineers, and keep the evidence your auditor will ask for. We also tell you early when a regime needs an independent assessor.

    Do you need production access in week one?

    Read-only access to the cloud account, the repositories and the pipeline is enough for the checks. Write access comes later, scoped to agreed changes and removable at any time.

    Can you cut our cloud bill with no migration?

    Often. Idle resources, oversized instances and unused commitments are the first places we look, and none of them needs a move.

    Do you run penetration tests?

    We test applications and pipelines with your engineers and fix what we find. Some buyers still require an independent tester, and we prepare your systems and records for that test.

    Book a week-one review

    Give us read-only access to one cloud account and one critical application. At the end of the first week you get the ten findings in writing.

    Book a reviewChoose another practice