In my previous post, I talked about how cloud security has become a reactive game— issues only being addressed after they are detected in production. At first glance, it seems there’s a solution in the form of “shift-left” practices—scanning IaC templates and managing configurations before deployment. However, these methods often assume a level of simplicity in cloud environments that just is not common in the real world.

Infrastructure as Code (IaC) was supposed to simplify and standardize cloud deployments, but only 13% of organizations have fully matured their IaC programs. Many still rely on manual processes, “ClickOps” or partial automation that are prone to countless misconfigurations. This complexity is compounded by the number of stakeholders touching the cloud environment: DevOps teams, IT departments, third-party vendors, and even M&A-driven “sub-organizations” operating under the same corporate umbrella. Each one adds a new layer, a new tool, and opens the door to misconfiguration.

The result? A lot more than just theoretical risk. Take the December 2024 incident at Volkswagen: a significant data breach exposed sensitive information including vehicle locations, customer information, and operational details on roughly 800,000 electric vehicles, all traced back to a cloud misconfiguration managed by a third-party provider. In cases like this, organizations relying on external vendors have limited control over their own security posture, leaving them exposed. Reactive cloud security measures and traditional CSPM approaches simply weren’t enough to prevent this incident. But then, what security approach could possibly work when an external vendor holds the keys to your cloud kingdom?

Isn’t it time we rethink cloud security entirely? Instead of resolving problems post-deployment, perhaps we need a truly proactive strategy—one that aligns with the realities of modern, multi-stakeholder, hyper-scaled cloud environments. If we don’t adapt now, we risk chasing one misconfiguration after another, never pausing to address the root cause: complexity itself.

‍Sources:

1. Is Something Missing in Cloud Security? https://lnkd.in/dKmUGTAj
2. ‍StackGen 2025 Report https://lnkd.in/d2M6ySQ
3. ‍Volkswagen Breach https://lnkd.in/dfD7gD4e