Resources

A leaked cloud credential is usually treated as a detection problem. Find it, revoke it, rotate it, and move on. But the Volkswagen and Cariad data exposure raises a more important question: why was there a long-lived credential worth stealing in the first place? When a single reusable key can unlock sensitive cloud data, the leak is only part of the problem - the configuration that allowed that key to exist is the other.

On 29 July 2019, Capital One disclosed that an attacker had taken data relating to roughly 106 million people across the United States and Canada. The attacker was Paige Thompson, a former Amazon Web Services engineer, who was arrested the same day and convicted on computer fraud charges in June 2022. The company's settlements reached around $190 million.

Cloud attacks don’t always begin with a vulnerability. Often, they begin with a misconfiguration that gives an attacker a path in. In Part 1 of this series, we look at cloud environments from the attacker’s perspective and break down the three conditions behind many exploitable cloud attack paths: Resource DIscovery, Network Accessibility, and Identity-Based Access.

Your cloud security tools may be working exactly as designed. That’s the problem.

Security teams are still finding and fixing the same misconfigurations over and over. The issue isn’t the tools-it’s a reactive model that detects risk after it already exists. Here are five signs that model has reached its limit.

‍

Cloud remediation is rarely as simple as changing a setting. Fixes can break production, require architectural changes or migrations, and conflict with IaC ownership. Prevention takes a different path: enforce the right configuration before deployment, while the resource is still cheap and safe to change. This article explores the challenges of remediating issues safely and effectively, and highlights what teams need to consider when remediation is unavoidable.

Aryon's research reveals millions of misconfigured ephemeral cloud resources, publicly exposed for only moments before being removed. Often, these exposures last only a few minutes, long enough for attackers to discover and exploit them, but too short for traditional CSPM and CNAPP tools to detect. Many of these resources contain highly sensitive information.

In cloud environments, security and operations often meet too late. Security teams define the policies, best practices, compliance requirements, threat models, and risk tolerance that should guide how cloud resources are configured. DevOps and IT teams apply those decisions in practice as they create, configure, and change cloud resources every day.

How Marriott, SolarWinds, and Salesloft/Drift expose a structural flaw in modern cloud security and how to fix it before the next breach starts.

As we close the chapter on 2025, we find ourselves reflecting on a year shaped by three powerful forces: curiosity that pushed boundaries, relentless execution that turned ideas into impact, and, above all, operational proof that our approach works.

‍

Cloud security has a fundamental structural problem, and most organizations are only beginning to fully recognize it. Despite significant investment in tooling and talent, security teams remain perpetually reactive, identifying misconfigurations after they have already reached production, triaging growing volumes of alerts, and working to remediate risks that have already existed in a potentially exploitable state, following the CSMM Model can change things around.

“The cloud is just someone else’s computer.” It’s a funny saying that oversimplifies what cloud computing really means. In reality, anyone who has dealt with cloud security knows the cloud is far more complex than just renting another person’s server.

‍

Cloud complexity is increasing due to multiple stakeholders and fragmented processes. A recent Volkswagen breach highlights the risks of misconfigurations, particularly those introduced by third-party vendors.

Cloud security remains reactive, with 61% of organizations facing cloud incidents in 2024 and misconfigurations driving 99% of cloud compromises. CSPM tools provide visibility but don’t break the cycle, leaving security teams overwhelmed.