Is Something Missing in Cloud Security?
Cloud security remains reactive, with 61% of organizations facing cloud incidents in 2024 and misconfigurations driving 99% of cloud compromises. CSPM tools provide visibility but don’t break the cycle, leaving security teams overwhelmed.
.webp)
I've been spending the last few years getting as intimately familiar as possible with the cloud security problem space.
One thing that stood out above all else during this process is the collective consensus that cloud security is a reactive game - with issues only being addressed after they are detected in production. By then, the damage is potentially done—sensitive data could be exposed, compliance may be at risk, and entire teams scramble to respond rather than address the underlying causes.
This isn’t just my personal observation. The numbers are hard to ignore. A 2024 report reveals that 61% of organizations dealt with cloud security incidents this year, and over a fifth led to data breaches. Even Gartner® predicts that through 2027, 99% of cloud compromises will stem from user misconfigurations.
What does this look like day-to-day? CSPM tools have improved visibility—they let us know quickly when something is amiss. But the fundamental nature of cloud security remains stuck in a reactive loop, generating a flood of unresolved issues, lengthy mean-time-to-resolutions, and friction between teams. As a result, security and operations teams often find themselves going down a rabbit hole, navigating complex, time-consuming investigations that distract from more strategic initiatives.
We need to find a way to break this reactive cycle. If we continue down the same path, the complexities of the cloud will keep outpacing us. Isn’t it time we started imagining a different way forward?
Notes & Sources
- Checkpoint 2024 Cloud Security Report - https://lnkd.in/dJ22i5Sk
- Gartner® via Cloudflare - https://lnkd.in/dGjtfyxT
Continue reading
.png)
The Key That Should Not Have Worked
A leaked cloud credential is usually treated as a detection problem. Find it, revoke it, rotate it, and move on. But the Volkswagen and Cariad data exposure raises a more important question: why was there a long-lived credential worth stealing in the first place? When a single reusable key can unlock sensitive cloud data, the leak is only part of the problem - the configuration that allowed that key to exist is the other.
.png)
The Role That Should Never Have Existed
On 29 July 2019, Capital One disclosed that an attacker had taken data relating to roughly 106 million people across the United States and Canada. The attacker was Paige Thompson, a former Amazon Web Services engineer, who was arrested the same day and convicted on computer fraud charges in June 2022. The company's settlements reached around $190 million.
Exploiting Cloud Misconfigurations: How Attackers Find Cloud Attack Paths (Part 1 - The Basics)
Cloud attacks don’t always begin with a vulnerability. Often, they begin with a misconfiguration that gives an attacker a path in. In Part 1 of this series, we look at cloud environments from the attacker’s perspective and break down the three conditions behind many exploitable cloud attack paths: Resource DIscovery, Network Accessibility, and Identity-Based Access.
Five Reasons Your Cloud Security Solution Is Failing You
Your cloud security tools may be working exactly as designed. That’s the problem.
Security teams are still finding and fixing the same misconfigurations over and over. The issue isn’t the tools-it’s a reactive model that detects risk after it already exists. Here are five signs that model has reached its limit.
50 Ways to Break Production - Why Cloud Security Remediation Is Harder Than It Looks
Cloud remediation is rarely as simple as changing a setting. Fixes can break production, require architectural changes or migrations, and conflict with IaC ownership. Prevention takes a different path: enforce the right configuration before deployment, while the resource is still cheap and safe to change. This article explores the challenges of remediating issues safely and effectively, and highlights what teams need to consider when remediation is unavoidable.
Cloud ShutterGap: Millions of Cloud Resources Exposed - The Blind Spot CSPM/CNAPP Tools Don’t Cover
Aryon's research reveals millions of misconfigured ephemeral cloud resources, publicly exposed for only moments before being removed. Often, these exposures last only a few minutes, long enough for attackers to discover and exploit them, but too short for traditional CSPM and CNAPP tools to detect. Many of these resources contain highly sensitive information.