Weak IAM affects up to 98% of cloud environments
Misconfiguration remains one of the leading threats to cloud environments because a single configuration error can result in public network access, unrotated keys, missing encryption, exposed services, and logging gaps. CISA now mandates baseline cloud configuration practices for US federal agencies.
More than two-thirds of midmarket organizations use multiple cloud providers, each with its own security model, terminology, and configuration settings. The same security issue can manifest differently across AWS, Azure, and Google Cloud, often requiring a different approach to identify and remediate, according to Intruder’s 2026 Cloud Security Index report.
“There’s a common assumption that moving to the cloud makes you secure by default,” said Chris Wallis, CEO and founder of Intruder. “This data shows the opposite: every platform has different weaknesses, and security teams have to understand and address the specific risks on each one. You can’t just configure once and assume you’re covered.”
Cloud security risks by platform
The most common cloud security issues vary across AWS, Azure, and Google Cloud, driven by each platform’s architecture. AWS environments are most frequently affected by storage, network access, and identity management misconfigurations. Azure’s most common issues center on storage security and identity protection, particularly unrotated access keys, publicly accessible storage, and missing MFA.
Google Cloud is primarily affected by identity and access management (IAM) weaknesses, including missing MFA, unused service accounts, and overly permissive service accounts.
Weak identity controls, excessive permissions, and insecure or incomplete configurations remain the most common sources of cloud security risk across all three providers.
Comparing cloud security risks
Weak IAM controls and missing logging and alerting were the most widespread security issues across all three cloud providers, affecting 80% to 98% of accounts.
AWS recorded the highest prevalence of misconfigurations in five of the six security categories analyzed, including permissive firewalls, exposed services, and weak encryption. Azure had the highest rate of misconfigured services. Google Cloud recorded the lowest prevalence in four of the six categories.
Exposed services showed the widest variation, affecting 76% of AWS accounts, 64% of Azure accounts, and 8% of Google Cloud accounts. These differences are due in part to the breadth of each provider’s service portfolio and differences in their approach to secure default configurations.
Remediation trends by organization size
Cloud security posture also varies by organization size. Larger enterprises generally report fewer issues with permissive firewalls, exposed services, and weak encryption than smaller organizations, indicating more mature security processes and greater investment in cloud security.
IAM is the only category that becomes more challenging with scale. Weak IAM controls affect 87% of SMEs, 95% of midmarket organizations, and 98% of large enterprises. The increase is attributed to the growing complexity of managing users, roles, and permissions across larger environments.
Organization size also affects remediation times. Smaller organizations resolve cloud misconfigurations in an average of 8 to 16 days. The average remediation time peaks at 35 days among organizations with 1,000 to 5,000 employees, falls to 19 days among organizations with 5,000 to 10,000 employees, and drops to 10 days for the largest enterprises. Midmarket organizations often manage enterprise-scale cloud environments without the dedicated security resources available to larger companies.