How a Reinsurer Proved Cloud Defenses Ahead of Migration

Embedding Security in Cloud Migration

A cloud migration creates new access paths, permissions and data flows in a short time, and under the AWS shared responsibility model, securing them stays with the organization, not AWS.

The European Champions Alliance (ECA) has published an article describing how Mitigant and Cyberlift, a Paris-based cloud security consultancy, helped a French reinsurer validate its AWS security controls before moving sensitive systems to the cloud.

The reinsurer needed evidence that its defenses would hold before moving sensitive systems to AWS. Cyberlift tailored attack scenarios to the reinsurer's business priorities and ran them safely with Mitigant Cloud Attack Emulation, using attacks mapped to MITRE ATT&CK. The results became a risk-prioritized action plan.

Key Results

Cyberlift reported the following results:

• 65% of simulated attacks succeeded: revealing exploitable attack paths before the migration.
• Over 40 recommendations: to reduce cloud security risks.
• Over 10 best practices: to strengthen the security baseline.
• A clearer view of detection and response capabilities: with concrete actions for the teams.

One scenario combined data theft with ransomware: an attacker disabled logging, copied a storage bucket to an external account, and encrypted the copy.

Cloud Security in the Agentic Era 

Mitigant is an AI-powered adversary emulation platform for AWS, Azure, and GCP. Organizations use Mitigant to validate security controls by safely running attacks against cloud and AI workloads.

Consultancies like Cyberlift use Mitigant to deliver cloud security assessments for their clients. Teams validate controls whenever they need to, for example, ahead of a migration, after a release, or every week, and retest once fixes are in place.

Adversaries are increasingly leveraging agentic workflows to attack organizations at machine speed and at almost no cost. Mitigant brings the same speed to defenders:

• Mitigant MCP Server: security teams work with Mitigant from AI agents via Claude Code, Kiro, and other tools, turning attack execution into managed attack lifecycle management.
• AI red teaming for Amazon Bedrock: attacks against Bedrock and AgentCore workloads, covered in the Effective Red Teaming in the Agentic Era series.
• MITRE ATT&CK v20: the new AI techniques adversaries use, and how they relate to existing cloud techniques.

Get a demo environment to see Mitigant in action, or become a Mitigant partner.

Read the full field report on Cyberlift's LinkedIn page.

‍