The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Start with an evidence-based dependency check: inventory every direct and indirect cloud service your organization uses, match the reported attack to the exact provider product, region, tenant and dates, then investigate your own identities, logs and data with the service’s shared-responsibility model in mind. A cyberattack against a provider does not by itself prove that your organization’s tenant or data was compromised.
What you are trying to establish
A reliable answer has three separate parts:
- Dependency: Does your organization use the provider, directly or through a supplier, managed service provider (MSP), identity integration or embedded application?
- Scope overlap: Does your exact product, account or tenant, region and date range fall within the incident notice?
- Customer impact: Is there evidence of unauthorized access, data exposure, credential misuse, configuration tampering, service disruption or another effect in your environment?
Keep those questions separate in your incident record. A provider may report an attempted intrusion, an outage or an attack on infrastructure without confirming customer-data access. Conversely, a notice that does not name your tenant is not proof that your organization was unaffected. When public information cannot answer the question, obtain a written response through the provider’s security or support process.
As an Amazon Associate I earn from qualifying purchases.
Why a provider attack does not automatically mean your data was breached
Cloud services operate under a shared-responsibility model. The provider controls some layers, while the customer controls others; the boundary changes with the service and the configuration. The Cybersecurity and Infrastructure Security Agency’s TIC 3.0 Cloud Use Case describes incident response as shared responsibility in an agency context. The same practical principle applies to a private organization, but your contract determines the precise obligations.
For example, a provider can investigate its physical facilities, hypervisor, managed control plane and internal logs, while your team must examine administrator accounts, API keys, application settings, data exports and endpoints. A SaaS customer normally has less visibility into the underlying platform than an IaaS customer, but it still has to investigate its users, permissions, integrations and data. CISA explains these differences in its cloud-use guidance, and AWS’s incident-response guide similarly assigns responsibilities according to the selected service and customer configuration.
#1 Best Overall
Google Cloud’s process gives a useful example of careful terminology. It defines a data incident as a breach of its security that leads to destruction, loss, alteration, unauthorized disclosure or access to customer data on systems it manages or controls. That is Google Cloud’s contractual definition, not a universal legal definition. Its data-incident response process describes escalation, mitigation, resolution and customer notification; the page states it was updated in June 2026.
Step 1: Build a complete cloud-dependency inventory
Do not begin with a list of famous cloud platforms. Start with evidence from the way your organization pays for, authenticates to and operates technology. Cloud services can be enabled by a business unit without a central infrastructure change.
Pull names from financial and procurement records
- Accounts-payable transactions, corporate-card statements and billing exports.
- Procurement systems, contracts, renewals, purchase orders and data-processing agreements.
- Departmental budgets and expense reports that identify team-purchased applications.
Ask finance and procurement to search for parent companies and resellers as well as product names. A supplier’s legal name may not resemble the service name employees use.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check identity, network and endpoint evidence
- Single sign-on catalogs and identity-provider enterprise applications.
- Multi-factor authentication registrations, service principals and OAuth consent records.
- DNS zones, certificates, reverse proxies, VPN configurations and firewall rules.
- Managed-device and browser inventories showing extensions, agents or bookmarked administration portals.
- Cloud account, organization and subscription consoles.
Ask engineering and business owners
Review deployment pipelines, infrastructure-as-code repositories, container registries, monitoring dashboards, data integrations and backup jobs. Interview application owners about tools bought outside central IT. Include services hidden behind another product: an analytics provider may host data on a separate platform, and an MSP may administer your cloud accounts without being the underlying provider.
Record useful identifiers, not just names
For each service, capture:
- Provider, product, edition and service model.
- Legal contracting entity, account, subscription, project or tenant identifier.
- Region or data-residency location and the dates the service was active.
- Business owner, technical administrator, support contact and escalation path.
- Data categories, including credentials, personal data, financial records, source code and regulated information.
- Identity integrations, privileged third parties, connected applications and exposed interfaces.
- Backup location, recovery owner and any independent copy of critical data.
Mark each record as confirmed, probable or unverified. An inventory is a living control, not a one-time spreadsheet. The UK National Cyber Security Centre’s cloud shared-responsibility guidance notes that cloud services may be run by other organizations and recommends confidence in both the service and its underlying platform. That is why suppliers and MSPs belong in the same dependency map.
Step 2: Verify the reported cyberattack
Before comparing your inventory with a headline, create a short incident profile from primary sources.
- Identify the authoritative notice. Check the provider’s security, trust-center and service-health pages first. Then look for notices from national cyber agencies, regulators or sector authorities.
- Record the incident identity. Save the advisory number or incident name, publication and update times, and the provider business unit that issued it.
- Define the technical scope. Note named products, control planes, regions, environments, attack path and affected dependencies.
- Define the time window. Record when activity was first observed, when it began if known, when it ended or was contained, and every subsequent update.
- Classify the reported effect. Distinguish attempted activity, service disruption, unauthorized access, integrity changes and confirmed customer-data impact.
- Preserve the original wording. Download notices or record stable links and hashes if your process requires them. Status pages can change as facts develop.
Prefer reporting that links to a provider statement rather than repeating an unverified claim. Keep “attack on provider” and “impact to customer data” as different fields in your incident log.
Step 3: Match your services to the incident scope
For every inventory entry, compare the exact values—not a brand-level match.
| Match question | Evidence to check | What a positive match means |
|---|---|---|
| Is it the same provider and product? | Contract, tenant portal, billing record and provider notice | The service is a candidate for deeper review; a corporate relationship alone is insufficient. |
| Is the region or environment included? | Account settings, resource metadata, data-residency records and deployment manifests | Your resources may share the affected infrastructure or control path. |
| Do the active dates overlap? | Subscription history, deployment logs and the incident time window | Use activity logs from the overlapping period in the investigation. |
| Was your tenant, account or project named? | Provider customer notice, support case and account communications | Treat the overlap as customer-specific until the provider clarifies impact. |
| Was the affected feature enabled? | Configuration history, API usage and application integration records | Investigate the identities, data and actions connected to that feature. |
| Is there an indirect path? | Supplier contracts, SSO applications, MSP access and software dependency maps | Investigate the supplier’s access and request its own impact assessment. |
Do not infer “unaffected” merely because a public notice is silent about your account. Ask the provider whether your tenant, region, logs or data types were involved, and request the answer in writing when it will drive containment, disclosure or recovery decisions.
Step 4: Investigate according to the service model
The service model determines what evidence you can access and which actions are yours. Use the provider’s contract and technical documentation to refine this baseline.
| Service model | Customer investigation focus | Provider-dependent evidence |
|---|---|---|
| SaaS | Users, administrator roles, SSO events, MFA and recovery changes, API tokens, OAuth grants, exports, sharing links, application activity and data accessed | Underlying host, application and provider-control-plane logs; tenant isolation and provider-side forensic findings |
| PaaS | Application code, secrets, service accounts, deployment history, data stores, network rules and unusual application behavior | Managed runtime, host, platform control-plane and physical infrastructure evidence |
| IaaS | Instances, images, operating systems, IAM, keys, security groups, network flows, snapshots, workloads and backups | Physical facilities, hardware, hypervisor and provider-managed network or control-plane evidence |
CISA notes that SaaS customers generally rely more on the provider for incident handling, while PaaS and IaaS customers carry more direct responsibility but still depend on the provider for physical network and hardware access. AWS describes the same division in its incident-response guidance. Neither model removes the need to examine your own identities and configuration.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchReview identities and privileged access
- List administrator, break-glass, service and machine identities.
- Compare sign-ins, impossible-travel alerts, new devices, MFA resets and recovery-channel changes with the incident window.
- Inspect new roles, policies, access keys, OAuth grants, API tokens and delegated administrator relationships.
- Check whether an MSP, supplier or integration had privileges that could reach the affected service.
Review data and application activity
- Search audit events for unusual reads, exports, downloads, sharing changes and bulk deletions.
- Compare configuration and deployment history for unexpected endpoints, forwarding rules, scheduled jobs or public exposure.
- Examine application, database, endpoint and network telemetry for behavior that began during or shortly after the provider’s incident window.
- Validate backup creation, retention and restoration paths; assume a backup is not independent merely because it has a different name.
Step 5: Preserve evidence before changing the environment
Cloud evidence can disappear when retention periods expire, sessions are revoked or resources are rebuilt. CISA’s #StopRansomware Guide recommends preserving volatile evidence and enabling logging and alerts for cloud resources.
Rank #3
- Export customer-accessible audit, identity, network, application and configuration logs for the relevant window.
- Record the export time, time zone, account and resource identifiers, retention setting and the person who collected each file.
- Capture provider notices, status updates, support case numbers, chat transcripts and customer-specific communications.
- Preserve suspicious images, snapshots, tokens, emails and endpoint artifacts under your evidence procedure.
- Ask the provider what logs and forensic artifacts it holds, how long they will be retained and how they can be requested.
Do not wait for certainty before preserving evidence. A low-confidence lead can become important after the provider publishes a new indicator or expands the affected time window.
Step 6: Contain with the provider, not against it
Containment can include disabling exposed credentials, revoking sessions and tokens, restricting network paths, isolating workloads, removing unauthorized integrations and protecting backups. Sequence those actions with the provider and your incident lead when they could destroy evidence, interrupt a shared control plane or affect other tenants.
Use the provider’s published security contact and the escalation clauses in your contract. The NCSC guidance recommends contractual obligations requiring providers and their supply chain to work with the customer’s incident-response team, as well as the ability to audit MSP interactions. Record who authorized every containment step, its time in UTC or with an explicit time zone, expected effect and rollback plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Questions to send the provider
- Which products, regions, control planes and dates were affected?
- Was our tenant, account, project or data specifically observed in the incident?
- Which indicators, compromised identities, tokens or infrastructure should we search for?
- What customer-side logs and provider-held evidence are available, and what are their retention periods?
- Were any credentials, keys, sessions, backups or integrations invalidated or rotated by the provider?
- What containment, restoration and notification actions does the provider recommend?
- When will the next update arrive, and which channel is authoritative?
Step 7: Decide whether notification or reporting is required
Escalate the facts to legal, privacy, compliance and the accountable business owner. Reporting duties depend on jurisdiction, contract, data type, sector rules and confirmed facts; there is no single universal deadline established by the guidance cited here. Preserve the distinction between suspected access, confirmed access and an inability to determine access because evidence is unavailable.
Provide decision-makers with a timeline, affected services and regions, data categories, evidence collected, provider statements, containment actions, remaining uncertainties and planned next update. This prevents a provider’s broad incident announcement from being treated as a conclusion about your organization.
When several cloud providers or services are involved
Prioritize investigation rather than treating every dependency equally. The following decision axes are useful when the same incident touches multiple services:
- Business criticality and recovery priority: investigate systems whose loss would stop essential operations first.
- Data sensitivity and residency: elevate services containing regulated, confidential or location-restricted data.
- Service model and visibility: allow more time for provider evidence where you cannot access the underlying layer.
- Region and incident-window overlap: focus first on resources that match both.
- Notification and evidence access: prioritize providers that report confirmed tenant impact or cannot preserve requested evidence.
- Identity and third-party privileges: investigate shared administrators, SSO, keys and MSP paths that could cross services.
- Backup independence and recovery time: verify that recovery copies are available if the provider remains impaired.
- Contractual cooperation: use escalation, audit and reporting terms where technical answers are incomplete.
Common mistakes and how to correct them
Searching only the central IT asset list
Department-purchased SaaS, trial accounts and supplier-operated platforms are often absent. Reconcile finance, SSO, DNS, browser, procurement and engineering records, then ask business owners directly.
Treating a provider name as the incident scope
Large providers operate many products and regions. Match the exact service, account, tenant, feature and date before assigning investigative priority.
Assuming a status page is a security conclusion
A service-health update may describe availability while omitting forensic detail. Obtain the security notice and ask whether customer data or credentials were involved.
Rotating everything before collecting evidence
Emergency rotation may be necessary, but it can erase useful context. Export logs, capture current state and coordinate the sequence with the incident lead and provider.
Relying on the provider for every layer
Provider controls do not replace customer checks of identities, permissions, integrations, application behavior, data access and backups.
Recommended Free Tools
Declaring safety because no notice names your tenant
Public notices are not always tenant-level. Record the uncertainty and request a written customer-specific assessment.
Best Value
Leaving suppliers and MSPs outside the response plan
An indirect administrator or data processor can create the path to your environment. Require cooperation, evidence preservation and a named escalation contact.
A reusable incident-verification checklist
- Inventory direct, indirect, departmental and supplier-operated cloud services.
- Record product, tenant or account, region, dates, owners, data types and support contacts.
- Save the provider advisory and independent government or regulator notices.
- Write down affected products, regions, attack type, dates and stated customer impact.
- Compare every dependency with the incident scope and mark confirmed or uncertain matches.
- Ask the provider for a written tenant-specific assessment where public information is insufficient.
- Review identities, MFA, recovery channels, roles, keys, tokens, integrations and administrator activity.
- Review data access, exports, sharing, configuration, network, application and backup events.
- Export logs and preserve volatile evidence before retention or containment changes remove context.
- Coordinate credential revocation, isolation, recovery and provider actions through the incident plan.
- Record the timeline, case numbers, decisions, evidence owners and next update.
- Escalate notification and reporting decisions to legal, privacy, compliance and business owners.
How to improve readiness before the next attack
Turn the investigation into a standing capability. Review the dependency inventory on a defined schedule and whenever a new procurement, SSO integration or deployment occurs. Contract for notification, evidence retention, cooperation with your incident team, MSP auditability and clear escalation contacts. Test whether administrators can export the logs you will need, and verify that backup restoration does not depend entirely on the potentially affected provider.
Include provider coordination in tabletop exercises. A useful exercise begins with an ambiguous provider notice, requires the team to identify indirect dependencies, and ends with a documented decision about containment and notification. CISA recommends evaluating provider incident-response capabilities and integrating that coordination into the organization’s response plan; NCSC likewise emphasizes contractual cooperation across providers and supply chains.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Which cloud services does our organization use if there is no central inventory?
Reconcile accounts-payable and procurement records with corporate-card exports, SSO applications, DNS, endpoint and browser inventories, cloud consoles, deployment records, supplier contracts and interviews with business owners. Include MSPs and suppliers that can access data or administer environments.
Was our cloud provider affected, or was only its infrastructure targeted?
Compare the provider’s exact product, region, tenant or account and incident dates with your records. Then ask the provider for a written customer-specific assessment; a provider-level attack notice alone does not establish customer-data impact.
What should we check first after a provider cyberattack report?
Preserve relevant logs and notices, identify overlapping services and dates, review privileged identities and tokens, check audit events for unusual access or exports, and coordinate containment with the provider before changes overwrite evidence.
Who is responsible for investigating a cloud incident?
Responsibility is shared and varies by SaaS, PaaS, IaaS and configuration. The provider investigates layers it controls; the customer investigates its identities, settings, workloads, applications and data, while requesting provider-held evidence for inaccessible layers.
The Bottom Line
The dependable method is a documented chain from inventory to scope match to customer-side evidence. Identify every direct and indirect dependency, verify the provider’s exact incident boundaries, investigate the controls you operate, preserve evidence and obtain written provider coordination before concluding that your organization was or was not affected.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
