Intruder, a leader in exposure management, today released its 2026 Cloud Security Index, analyzing differences in cloud security risk across Amazon Web Services (AWS), Azure, and Google Cloud. Based on anonymized data from 3,000 Intruder customers covering over 12 months and ending in July 2026, the report highlights provider-specific vulnerability profiles, top misconfigurations, and average remediation timelines.
Cloud adoption has changed how organizations build and run infrastructure, but it has also moved more security decisions into the configuration layer. Seemingly minor configuration settings can create real exposure, from public network access and unrotated keys to missing encryption, exposed services, and logging gaps. Misconfiguration is consistently ranked as one of the top threats to cloud environments, and CISA now mandates baseline cloud configuration practices for U.S. federal agencies.
Security Risks in Multi-Cloud Environments
More than two-thirds of organizations operate multi-cloud environments, inherently complicating cloud security as each provider handles risks differently. The same issues can be surfaced in different ways, described using different terminology, and require a different fix depending on the platform.
Results from Intruder’s 2026 Cloud Security Index reveal that the top misconfigurations across AWS, Azure, and Google Cloud have almost no overlap, making it increasingly difficult for security teams to maintain a consistent security posture across multi-cloud environments. The report groups cloud issues into six categories (weak IAM controls, missing logging and alerting, misconfigured services, permissive firewalls, exposed services, and weak encryption) and compares prevalence across three providers. Key findings include:
- AWS leads in risk exposure: AWS leads in prevalence across five of the six categories. As the largest cloud provider by range of services, it offers the most configuration options, and with that the most opportunities for misconfiguration. The single most common AWS issue is S3 buckets that do not enforce HTTPS, at 87%, followed by permissive ingress to sensitive ports at 84% and IAM policies allowing privilege escalation at 83%.
- Azure storage and Entra ID gaps: Azure’s top three misconfigurations all stem from storage accounts, affecting between 61% and 67% of accounts. More than half of Azure accounts — 55% — contain Entra users without multifactor authentication (MFA).
- Google benefits from secure defaults: Google Cloud has the lowest misconfiguration rates across four categories, including the widest gap in publicly exposed services. Google Cloud also offers the fewest services.
- The gap between providers is stark: 76% of AWS accounts have publicly exposed services, compared to 64% on Azure and just 8% on Google Cloud. Permissive firewalls follow a similar pattern, affecting 83% of AWS accounts versus 45% on Azure and 34% on Google Cloud. For multi-cloud teams, this means security priorities must be set platform by platform.
“There’s a common assumption that moving to the cloud makes you secure by default,” said Chris Wallis, CEO and founder at Intruder. “This data shows the opposite: every platform has different weaknesses, and security teams have to understand and address the specific risks on each one. You can’t just configure once and assume you’re covered.”
Cloud Security Posture by Organization Size
As organizations grow, cloud security posture generally improves. Smaller organizations remediate cloud issues in 8 to 16 days. Remediation slows sharply in the 1,000–5,000 employee range, peaking at 35 days, before improving again at the largest sizes, with 10K+ organizations back down to 10 days.
This mirrors the pattern seen in Intruder’s 2026 Attack Surface Management Index: midmarket organizations face the longest remediation times, likely managing enterprise-level cloud complexity without the dedicated resources to match.
Identity and Access Management Weaknesses
Every provider has different weaknesses, but identity is where they converge. Weak IAM controls affect 87% to 97% of accounts across all three providers. IAM issues dominate Google Cloud’s own top four misconfigurations, with three out of four accounts missing OS Login controls.
IAM is also the only category that worsens steadily as organizations grow: 87% among SMEs, 95% among midmarket organizations, and 98% among large enterprises. Permissive firewalls and weak encryption both decline with size, but logging gaps and misconfigured services peak in the midmarket — the same organizations that take the longest to remediate.
About Intruder’s 2026 Cloud Security Index
Intruder’s 2026 Cloud Security Index can be found here. Teams interested in learning more about the Intruder platform and its cloud security offerings can find more information here and can get started with a free trial here.
About Intruder
Intruder’s exposure management platform helps lean security teams stop breaches before they start by proactively discovering attack surface weaknesses. By unifying AI penetration testing, attack surface management, cloud security and continuous vulnerability management in one intuitive platform, Intruder makes it easy to stay secure by cutting through the noise and complexity. Founded in 2015 by Chris Wallis, a former ethical hacker turned corporate blue teamer, Intruder is now protecting over 3,000 companies worldwide. Learn more at https://intruder.io and get real-time threat intelligence at https://cvemon.intruder.io
2026 Cloud Security Index FAQ
Q: What is the main takeaway from the 2026 Cloud Security Index?
A: The primary takeaway is that cloud security risk is fundamentally fragmented across cloud providers. Over two-thirds of organizations operate multi-cloud environments, yet the top misconfigurations across AWS, Azure, and Google Cloud show almost no overlap. AWS risk is dominated by open storage and permissive firewalls. Azure risk centers on storage key management and identity access without MFA. Google Cloud risk is overwhelmingly tied to IAM. Security teams cannot apply a single blanket approach as they must navigate distinct configurations, terminology, and risk profiles for each provider.
Q: Why does AWS show higher misconfiguration rates compared to Google Cloud?
A: AWS is the largest cloud provider by service volume, offering the broadest set of configuration options. More granular configuration levers naturally creates more opportunities for human error. Furthermore, Google Cloud operates under a “shared fate” model with more secure default settings enabled out of the box, whereas AWS’s traditional shared responsibility model places greater burden on users to actively harden configurations.
Q: Why do midmarket organizations take the longest to fix cloud security issues?
A: Midmarket organizations (1,000–5,000 employees) experience a distinct operational squeeze in that they operate enterprise-grade cloud complexity across multiple platforms, but lack the dedicated security engineering teams and automated workflows available to 10,000+ employee enterprises. Smaller organizations (under 250 employees) fix issues in 8–16 days due to smaller, less complex infrastructure, while large enterprises leverage automated remediation tooling to bring resolution times back down to 10 days.
View source version on businesswire.com: https://www.businesswire.com/news/home/20260811053239/en/
Media gallery
