.svg)
Key Points
Juggling multiple cloud providers is complicated enough without each one failing in different places. But that's what Intruder’s 2026 Cloud Security Index found: the issues that dominate on AWS barely overlap with those on Google Cloud, and Azure looks different again. For security teams, this doesn't just create more work: it fragments teams' understanding of risk, makes prioritization harder, and can slow down remediation.
That matters because misconfiguration is consistently where cloud breaches start. The CSA ranks it among the top threats to cloud environments and CISA now mandates baseline configuration practices for US federal agencies.
Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud over the 12 months to July 2026. We wanted to know what the most common issues are across the top cloud providers, how they compare across key risk categories, how risk changes with organization size, and how quickly teams fix what they find.
Get the 2026 Cloud Security Index here
What are the most common misconfigurations in AWS?
These are the misconfigurations that affected the highest percentage of AWS accounts:
- S3 Does Not Enforce HTTPS — 87%
- Permissive Ingress to Sensitive Ports (via ACL) — 84%
- Overly Permissive Network ACL — 83%
- IAM Policy Allows Privilege Escalation — 83%
- VPC Endpoint Not Enabled for EC2 — 82%
- Block Public Access Not Enabled (S3 Account Level) — 81%
- VPC Subnet Auto-Assigns Public IP — 72%
- Root Access Not Centrally Managed — 72%
- IAM Policy Attached To User — 71%
- IAM Access Key Not Rotated — 71%
S3 Does Not Enforce HTTPS tops the list at 87%. S3 is one of the most widely used cloud storage services, and while man-in-the-middle attacks against it are rare, there's little reason to leave plain HTTP available.
Permissive firewall weaknesses rank second and third. These may not expose anything dangerous today, but a tightly scoped firewall is what stops tomorrow's development work from introducing an exposure.
IAM Policy Allows Privilege Escalation ranks fourth. AWS Identity and Access Management (IAM) is notoriously complex, and managed policies that look safe can grant more access than intended. In one recent incident, an attacker went from exposed credentials to administrative privileges in under 10 minutes, compromising 19 AWS principals.
What are the most common misconfigurations in Azure?
These are the misconfigurations that affected the highest percentage of Azure accounts:
- Storage Account Key Rotation Not Enabled — 67%
- Storage Account Access Keys Enabled — 66%
- Storage Account Public Network Access Enabled — 61%
- Entra User Without MFA — 55%
- Trusted Launch Not Enabled — 45%
- Key Vault Secret Never Expires — 41%
- Disable Public Access Not Enabled (Key Vault) — 41%
- Key Vault Not Recoverable — 38%
- Storage Blob Public Access Enabled — 36%
- Key Vault Using Legacy Access Control Model — 34%
The top three misconfigurations all relate to Azure Storage Accounts, which frequently hold sensitive data like customer personally identifiable information (PII). All three affect a similar share of accounts (between 61% and 67%), which suggests that where storage accounts aren't hardened, several controls tend to be missing at once.
More than half of accounts have Entra users without multi-factor authentication (MFA). That matters well beyond the cloud, because Entra ID governs access to Microsoft 365, third-party SaaS, and on-premises systems too. The 2024 Midnight Blizzard breach of Microsoft's own network started with a password spray against a legacy test account that didn't have MFA enabled.
What are the most common misconfigurations in Google Cloud (GCP)?
These are the misconfigurations that affected the highest percentage of Google Cloud accounts:
- OS Login MFA Not Enabled — 77%
- OS Login Not Enabled — 76%
- Unused Service Account — 75%
- Overly Permissive Service Account — 53%
- Permissive Ingress to Sensitive Ports — 34%
- Service Account Key Not Rotated — 31%
- Default Network In Use — 29%
- Service Account Unused Key — 29%
- Block Project-Wide SSH Keys Not Enabled — 26%
- Shielded VM Not Enabled — 21%
IAM issues dominate the top four, with more than three-quarters of Google Cloud accounts missing OS Login controls: the more secure alternative to traditional SSH. The rest of the list splits between permissive firewalls, IAM attack surface bloat from unused or unrotated keys, and missing compute hardening. Their prevalence suggests many Google Cloud environments are still running close to a default configuration.
Which cloud provider is most secure?
Based on misconfiguration rates across our dataset, Google Cloud had the lowest prevalence of issues in four out of six categories, while AWS had the highest in five. But the picture is more nuanced than a single winner: weak IAM and missing logging affect 80–98% of accounts regardless of provider, and the gaps between platforms vary enormously by category.
We grouped issues into six categories and compared prevalence across the three providers.
Weak IAM controls and missing logging and alerting are near-universal regardless of provider: between 80% and 98% of accounts are affected across the board.
The biggest gap is in exposed services. 76% of AWS accounts had at least one exposed service, compared to 64% on Azure and just 8% on Google Cloud. Permissive firewalls follow a similar pattern, affecting 83% of AWS accounts but only 34% on Google Cloud. Misconfigured services is the one category where Azure leads, at 80% versus 68% on both AWS and Google Cloud.
Part of the explanation is Google Cloud's different take on shared responsibility, a 'Shared Fate' model that ships more secure defaults out of the box. By contrast, independent assessments have found AWS places more of the burden on the user to configure securely, which may account for its higher prevalence.
Get the 2026 Cloud Security Index here
How does organization size affect cloud security posture?
For most types of issues, prevalence declines as organizations grow. Larger enterprises are less likely than smaller ones to have permissive firewalls, exposed services, or weak encryption, which points to greater maturity, investment, and operational discipline.
The exception is IAM, and it's a significant one. Weak IAM controls affected 87% of SMEs (1–250 employees), 95% of midmarket organizations (250–10K), and 98% of large enterprises (10K–100K+). More people means more roles, more permissions, and more complexity: a single overprivileged identity is often all it takes to bypass the controls that have been hardened elsewhere.
How long does it take to fix cloud misconfigurations?
Smaller organizations remediate cloud issues fastest, within 7–16 days. Remediation slows significantly as organizations grow into the 1,000–5,000 employee range, peaking at 35 days, before improving again at enterprise scale, where organizations with 10,000+ employees remediate in around 10 days.
This mirrors what we found in our 2026 Attack Surface Management Index: midmarket organizations face the longest remediation times, most likely because they're managing enterprise-scale cloud complexity without the dedicated resources to match. Many organizations are scaling their cloud usage before they have the resources, processes, or visibility to secure it efficiently.
What this means for security teams
For teams running more than one provider, the hard part isn't fixing different issues on different platforms: it's working out which risks matter most across the whole estate, so limited time goes to the right places first.
What teams need is a consistent way to assess posture across providers while keeping the platform-specific detail required to actually fix things. Without that, they're left with too much complexity, too little visibility, and not enough context to prioritize what matters. Intruder runs daily configuration checks across AWS, Azure, and Google Cloud, and prioritizes what it finds with clear remediation advice - so multi-cloud risk becomes something you can see and act on in one place. Get set up in minutes for free.
Vulnerabulletin
