Cloud Misconfigurations Differ Sharply by Provider, Intruder Data Shows

A new analysis of misconfiguration data from 3,000 organizations finds that security risk profiles across AWS, Azure, and Google Cloud have little in common. Intruder's 2026 Cloud Security Index grouped issues into six categories, including weak identity and access management (IAM), missing logging, misconfigured services, permissive firewalls, exposed services, and weak encryption.

Weak IAM controls and missing logging are near-universal, affecting 80% to 98% of accounts regardless of provider. The other categories diverge widely. Exposed services affect 76% of AWS accounts, 64% of Azure accounts, and 8% of Google Cloud accounts. Permissive firewalls hit AWS at 83%, Azure at 45%, and Google Cloud at 34%. Weak encryption affects 49% of AWS accounts, 35% of Azure accounts, and 8% of Google Cloud accounts. Misconfigured services is the exception: Azure leads at 80%, followed by AWS at 68% and Google Cloud at 37%.

The report suggests AWS's breadth of services creates more configuration options and more room for error, while Google Cloud's lower prevalence may reflect its narrower service range and a Shared Fate model that ships more secure defaults.

On AWS, the most common issues include S3 buckets that don't enforce HTTPS (87%), permissive ingress to sensitive ports (84%), and IAM policies allowing privilege escalation (83%). Azure's top problems center on storage accounts, including key rotation not enabled (67%) and access keys enabled (66%), while 55% of accounts have Entra users without MFA. Google Cloud's top issues are IAM-related, led by OS Login MFA not enabled (77%).

Weak IAM controls rise with organization size, affecting 87% of SMEs, 95% of midmarket organizations, and 98% of large enterprises. Midmarket organizations take the longest to remediate issues, at 35 days on average. The full report includes the top 10 misconfigurations per platform.

Source: The Hackers News