Cloud Misconfiguration as Attack Surface: Patterns from 50+ Assessments
The most prevalent misconfiguration classes across AWS, Azure, and GCP, ranked by exploitability and organizational blast radius.
Benchmarks measure deviation, not danger
Across fifty-plus cloud assessments, the gap between benchmark score and actual exploitability is consistent and wide. Organizations with strong CIS scores still fall to attack paths that chain individually "low" findings, while some flagged deviations carry no realistic blast radius. Ranking misconfigurations by exploitability and reachable impact — not by benchmark section — changes remediation priorities dramatically.
The five classes that recur everywhere
The same misconfiguration classes dominate regardless of provider: overprivileged identities (human and workload), public exposure of storage and snapshots, permissive network paths between environments that were meant to be segregated, secrets in plaintext across parameter stores and CI variables, and logging that exists but routes nowhere anyone watches. None are exotic. All persist because ownership is ambiguous.
Identity is the real perimeter
In modern cloud intrusions, the initial foothold is almost always a credential, and the escalation is almost always IAM. Role-chaining paths, wildcard trust policies, and stale federated access give attackers routes that never touch a firewall. Mapping privilege-escalation paths deserves the same rigor network teams once gave to firewall rule reviews.
Making fixes stick
Point-in-time remediation decays; the estate redrifts within a quarter. Fixes hold when they land in infrastructure-as-code rather than the console, when preventive guardrails (SCPs, policy-as-code) block reintroduction, and when drift alerts route to the owning team instead of a shared queue. Assessment without a durable enforcement layer is a photograph, not a control.