# Cloud Security Misconfigurations Vary Wildly Across Providers AWS leads in vulnerabilities while Google Cloud shows the fewest flaws in new 3,000-organization study - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-07 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/2869f48d-0323-451a-9b64-e4f2edb24722 ## The Cloud Security Paradox Intruder's analysis of 3,000 organizations reveals cloud security isn't one-size-fits-all. While weak IAM controls plague 80-98% of accounts universally, other risks diverge sharply. AWS leads in exposed services (76%) versus Google Cloud's 8%, with Azure dominating misconfigured services at 80%. This variability stems from differing service architectures - AWS's vast service catalog creates more configuration surfaces, while Google's 'Shared Fate' model ships secure defaults. The findings challenge the notion of universal cloud security checklists. ## AWS's Top Vulnerability Points S3 buckets without HTTPS enforcement impact most AWS accounts, despite rare MITM attack risks. More critically, 83% of accounts contain IAM policies enabling privilege escalation - a notorious AWS weak spot. Recent incidents show attackers gaining admin rights in under 10 minutes from exposed credentials. The complexity of AWS IAM means seemingly safe managed policies often grant unintended permissions. These findings underscore AWS's configuration challenges despite its market leadership. ## Azure's Storage Account Blind Spots Azure's top three issues cluster around Storage Accounts holding sensitive PII data. When these accounts lack hardening, multiple controls typically fail simultaneously. Half of accounts also have Entra ID users without MFA - a critical gap given Entra's broad access to Microsoft 365 and SaaS apps. The 2024 Midnight Blizzard breach originated from exactly this vulnerability, proving real-world consequences. Azure's control gaps often create chained vulnerabilities rather than isolated risks. ## Google Cloud's Identity Crisis Google Cloud's relative security advantage disappears in IAM, where 77% of accounts lack OS Login controls for secure SSH alternatives. While leading in secure defaults for network exposure and encryption, Google still struggles with fundamental access governance. The platform's fewer services reduce attack surfaces but don't eliminate identity-related risks. This suggests even 'secure-by-default' platforms require careful IAM configuration to prevent breaches. ## The Enterprise Size Paradox Larger organizations show better security in most categories except IAM, where weak controls affect 98% of enterprises versus 87% of SMEs. Midmarket firms take 35 days to remediate issues - 3x longer than large enterprises. This reveals a resource gap: midmarket teams manage enterprise-level complexity without equivalent security staff. The data contradicts assumptions that bigger always means more secure in cloud environments. ## Platform-Specific Risk Prioritization Effective multi-cloud security requires understanding which risks matter most per platform. AWS demands focus on S3 and IAM hardening, Azure needs storage account protections, while Google requires IAM attention despite fewer overall flaws. Security teams must balance cross-provider posture assessment with platform-specific remediation steps. This dual approach ensures limited resources target each cloud's unique weak points. ## The Shared Responsibility Reality Check The study highlights gaps in cloud providers' shared responsibility models. While Google's Shared Fate approach shows benefits in network security, no provider fully prevents IAM misconfigurations. Customers still bear unexpected configuration burdens - AWS's service breadth creates complexity, Azure's integrated services enable chained failures, and Google's simplicity doesn't eliminate access risks. Organizations must audit beyond provider defaults. ## The Coming AI Security Challenge With AI-powered attacks accelerating, cloud misconfigurations will become even riskier. The report warns that current remediation timelines (8-35 days) are unsustainable against automated threats. Organizations must adopt continuous misconfiguration detection and prioritize exploitable risks. As cloud complexity grows, security teams need real-time visibility into cross-provider vulnerabilities before attackers leverage them at scale. ## Sources covering this story - https://thehackernews.com/2026/09/your-cloud-security-checklist-doesnt.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._