As it will help our organization to identify vulnerabilities before a compromise could take place, the process is started by identifying and assigning severity levels to security defects through manual and automated techniques in a certain period of time. Be mindful that since this is related to cloud computing, there are two types of PT. First is the test the provider does to its own platform and second the test you could do to their resources, specifically for your systems. Importantly, not all cloud vendors allow penetration testing. Ideally, the assessment shall target different layers of technology from Host, Network, Storage, Server, Virtualization, Operating System, Middleware, Runtime, Database, and Application by highly considering your cloud models (SaaS, PaaS, IaaS, etc.) and cloud deployment models.