Sophisticated exploits make headlines, but most cloud compromises start with something far more mundane: a setting left open, a key left in a repository, a permission granted "temporarily" two years ago. Attackers know this, and they scan for these weaknesses automatically, around the clock.
Here are five misconfigurations that consistently appear in public breach reports and cloud provider guidance, and how to address each one durably rather than one ticket at a time.
1. Publicly accessible storage
Storage buckets and blob containers exposed to the internet remain a leading cause of data leaks. They are often created for a quick file share or a static website and later reused for sensitive data.
Fix it for good: enable account-level public access blocks, and use organisation policies to prevent public access from being re-enabled except through an approved exception process.
2. Long-lived access keys
Static credentials end up in code, CI variables, laptops and chat messages. Once leaked, they work from anywhere until someone notices.
Fix it for good: replace keys with federated, short-lived credentials: single sign-on for people, workload identity and OIDC federation for applications and pipelines. Add secret scanning to every repository.
3. Over-privileged identities
Wildcard permissions and broad administrator roles turn a minor compromise into a full takeover. Privilege-escalation paths, where a low-privilege identity can grant itself more rights, are particularly dangerous and hard to spot manually.
Fix it for good: analyse effective permissions against actual usage, remove what isn't used and require just-in-time elevation for administrative access.
4. Exposed management interfaces
SSH, RDP, database ports and Kubernetes API servers open to the internet are discovered within minutes of being exposed. Weak authentication or a single unpatched vulnerability is then enough.
Fix it for good: remove public exposure entirely. Use identity-aware proxies, bastion services or private endpoints, and enforce network guardrails that reject rules opening sensitive ports to the whole internet.
5. Missing or incomplete logging
When an incident happens, the first question is "what did the attacker do?" Without control-plane audit logs, data-access logs and adequate retention, there may be no answer, and no way to show regulators what was or wasn't accessed.
Fix it for good: enable organisation-wide audit logging into a separate, protected account or project, define retention based on your regulatory obligations, and test that your detections actually fire.
From findings to guardrails
Each of these issues can be fixed once by hand. The challenge is keeping them fixed as teams create new accounts, projects and workloads every week. That is why mature organisations move from detection to prevention: preventive policies at the organisation level, secure-by-default templates in infrastructure as code, and continuous checks in deployment pipelines.
Our cloud security posture assessment identifies these issues across your accounts and subscriptions, and our secure cloud architecture work turns the fixes into guardrails that last.