Weak IAM affects up to 98% of cloud environments
Intruder's 2026 Cloud Security Index finds weak IAM controls affect up to 98% of cloud environments across AWS, Azure, and Google Cloud.
Intruder's 2026 Cloud Security Index report analyzed cloud misconfigurations across midmarket and enterprise environments, finding weak IAM controls and missing logging affected 80% to 98% of accounts across all three major providers. AWS recorded the highest prevalence in five of six categories, including exposed services at 76% versus 8% on Google Cloud. IAM weaknesses worsen with scale, affecting 87% of SMEs, 95% of midmarket organizations, and 98% of large enterprises, while remediation times peak at 35 days for organizations with 1,000 to 5,000 employees.
- Exposed services affect 76% of AWS, 64% of Azure, and 8% of GCP accounts.
- Unrotated access keys and missing MFA are top Azure issues.
- Unused and overly permissive service accounts dominate Google Cloud findings.
- Midmarket remediation peaks at 35 days without dedicated security resources.
- Organizations
- CISA
- Countries
- United States
From the original article
2 min read at helpnetsecurity.com
Misconfiguration remains one of the leading threats to cloud environments because a single configuration error can result in public network access, unrotated keys, missing encryption, exposed services, and logging gaps. CISA now mandates baseline cloud configuration practices for US federal agencies.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.