Why it matters now
Identity, threat detection, vulnerability management, encryption and logging are set up inconsistently in almost every AWS estate we assess. The gaps are usually basic ones. Public S3 buckets, an unprotected root user, keys that have not been rotated and findings no one has acted on.
AI-powered tooling now discovers vulnerabilities faster than before, so you need to find and fix your own weaknesses faster too. If you are planning to adopt AI on AWS, a strong security foundation is what makes confident adoption possible.
What SHIP is
The Security Health Improvement Program is an AWS program, available at no cost to every AWS customer regardless of Support tier. It uses data from your own AWS environment to:
- run security checks and prioritise the findings
- give prescriptive recommendations specific to your environment
- map the right AWS security services to your use cases
- give you a roadmap to improve, and to keep improving
SHIP covers AWS’s core security use cases, including threat detection, cloud security posture management, vulnerability management, configuration management, access governance, application protection, application security testing, network security, encryption and secrets management.
It takes about two hours of your team’s time, split across a short discovery session and a delivery session. The assessment scan itself runs in minutes.
After the assessment
The SHIP scan gives you a point-in-time picture. Most of the value comes from what follows. Reading the findings in the context of your environment, deciding what matters most, fixing it properly, adopting the right AWS services in the right way, and operating the result so your posture does not drift back.
CirrusHQ does that work with you, from the first finding to a posture you can keep.
How CirrusHQ delivers SHIP
1. Assess, at no cost
We run the full SHIP engagement with you. A discovery session to agree your priorities, the data-driven assessment of your AWS environment, and a delivery session that walks you through prioritised findings and a clear roadmap. There is no charge and no obligation to go further.
2. Remediate
We turn the roadmap into a remediated environment. We close the high-priority findings, enable and configure the right AWS security services, enforce least privilege, encryption and logging, and set up the controls your environment needs. Scoped, priced and delivered by an AWS Premier Tier Services Partner.
3. Operate and keep improving
SHIP gives you a baseline. Staying secure needs ongoing work, so through our managed service we monitor, maintain and improve your posture, re-baselining as your environment and the threat landscape change. This is also the foundation for adopting AI on AWS with confidence.
Start with a no-cost assessment
We run SHIP with you and hand over prioritised findings and a clear roadmap. There is no charge and no obligation to go further.
Book your free SHIP assessmentWhy CirrusHQ
AWS Premier Tier Services Partner
The highest AWS partner tier. We hold AWS Competencies in Migration and Modernization, Education, DevOps, and Small and Medium Business.
100% AWS
AWS is all we do, so our whole team is focused on one platform.
AWS Managed Service Provider
We fix and then operate. We run environments at scale, with thousands of monitored events and rapid response to critical alerts every month.
Certified and accredited
More than 100 AWS certifications across the team, more than 200 AWS customer launches, and ISO/IEC 27001:2022.
Ready for the public sector
A Government Commercial Agency (formerly Crown Commercial Service) supplier on G-Cloud 15, and part of the AWS One Government Value Agreement (OGVA), with deep experience across higher education, research and government.
Proven with SHIP
We have run SHIP end to end with AWS for a UK university, from discovery to a delivered roadmap. Our customers rate us with an NPS of +93.
Who SHIP is for
Public sector and education
Compliance obligations, funding scrutiny and sensitive data make a verified, prioritised security baseline essential.
Organisations adopting AI on AWS
Get the foundation right before you deploy models on Amazon Bedrock or build agentic workflows. SHIP sets the baseline AI workloads need.
AWS customers that have grown fast
If your AWS estate has grown faster than your security practices, SHIP shows you where you stand in about two hours.
Frequently asked questions
Is the SHIP assessment really free?
Yes. SHIP is a no-cost AWS program open to every AWS customer regardless of Support tier, and CirrusHQ delivers the assessment and roadmap at no cost. You only pay if you ask us to remediate the findings or run your security on an ongoing basis.
How long does it take?
About two hours of your team’s time across a discovery session and a delivery session. The assessment scan of your environment runs in minutes.
What does the assessment look at?
Data from your own AWS environment, checked against AWS best practice across the core security use cases, with findings prioritised by severity and mapped to the right AWS services.
Do we have to use CirrusHQ for remediation?
No. The assessment and roadmap are yours to keep. Most customers ask us to remediate, because closing the gaps properly and keeping them closed takes the most effort.
Can we run SHIP more than once?
Yes. Each engagement gives a fresh baseline, so SHIP works well as part of a regular cycle of review and improvement.
Is this the same as SIP?
No. SHIP is the data-driven assessment of your AWS security services and practices, and is the right place to start. SIP (the AWS Security Improvement Program) is an AWS Support program that covers people and process through a questionnaire, for Enterprise Support customers.
Two hours to know exactly where you stand
Book a no-cost SHIP assessment with CirrusHQ. We will show you your AWS security gaps, prioritised and mapped to a clear roadmap. Then, if you want, we will close them.
Book your free SHIP assessment