Intruder analyzed misconfigurations across 3,000 organizations on AWS, Azure, and Google Cloud and found that risk profiles vary dramatically by provider. Treating cloud security as a single checklist leaves important, platform-specific gaps.
Weak IAM and missing logging are nearly universal: 80–98% of accounts across providers have at least one issue in those categories.
Organization size matters: weak IAM increases with company size, and midmarket teams take the longest (35 days) to remediate cloud issues.
A single, unified checklist is insufficient — prioritize provider-specific controls and focus on IAM as a cross-cutting failure mode.
The study compared how many accounts had at least one issue in each category. Key prevalence figures by provider:
Weak IAM controls and missing logging affect between 80% and 98% of accounts regardless of provider.
AWS shows high prevalence across five of the six categories. Intruder lists common concrete misconfigurations: S3 not enforcing HTTPS (87%), permissive ingress to sensitive ports via ACLs (84%), overly permissive Network ACLs (83%), IAM policies that allow privilege escalation (83%), and VPC endpoint not enabled for EC2 (82%). The breadth of AWS services increases configuration surface area and creates more opportunities for error.
Azure's most frequent issues cluster around Storage Accounts: lack of key rotation (67%), access keys enabled (66%), and public network access enabled (61%). Entra ID users without multi-factor authentication appear in 55% of accounts. These findings indicate storage configuration and identity hygiene as high-value targets for remediation on Azure.
Google Cloud's top issues are almost all identity-related: OS Login MFA not enabled (77%), OS Login not enabled (76%), unused service accounts (75%), and overly permissive service accounts (53%). Google Cloud shows much lower prevalence of exposed services and weak encryption compared with AWS and Azure.
How organization size affects risk and response
Most categories become less prevalent as organizations grow, except for IAM. Weak IAM controls increase with size: 87% of SMEs, 95% of midmarket organizations, and 98% of large enterprises have at least one IAM issue. Midmarket teams also take the longest to remediate findings — 35 days on average compared with 8–16 days for smaller businesses and about 10 days for large enterprises. The mismatch suggests midmarket teams face enterprise-level complexity without equivalent staffing or tools.
Practical implications for security teams
A single cloud security checklist that treats AWS, Azure, and Google Cloud the same will leave important gaps. Use provider-specific findings to prioritize controls and invest in IAM hygiene and logging across the entire estate.
The Diagram-to-Deployment Gap Cloud security architecture often begins with a strong design, account boundaries are defined, identity federation and vending patterns are selected, centralized security services are planned, and diagrams show how telemetry, governance, and incident response should work together. The desi
Most enterprise security programs focus on protecting servers, endpoints, and networks. This leaves browsers as busy yet vulnerable entry points into the business, since this is where employees log in to SaaS tools, identity providers, email, file storage, internal portals, AI assistants, finance platforms, customer re
A few months ago I got tired of hearing the same sentence in interviews and student forums: " we're on the cloud, so we're secure. " I understand where it comes from. AWS handles the physical data centers, the hypervisor, the network backbone, a huge amount of infrastructure most of us never think about. But the Shared
Most security policies say something confident about email. They mandate encryption in transit, specify retention periods, name the approved client and warn staff about attachments from unknown senders. The document reads well, so it gets signed off, filed, and produced during audits.
Security teams have become exceptionally talented at finding vulnerabilities. Now, it’s time to turn our attention to optimizing the process for determining which of those vulnerabilities actually create a path to compromise. A critical vulnerability may look alarming on a scanner report, but if it sits behind strong s
Introduction Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my organization fail the phishing simulation? Does this SIEM rule fire on this particular technique? And, in more mature organizations, this testing happens continuously rather than as
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.