Intruder released its 2026 Cloud Security Index, analyzing differences in cloud security risk across Amazon Web Services (AWS), Azure, and Google Cloud. Based on anonymized data from 3,000 Intruder customers covering over 12 months and ending in July 2026, the report highlights provider-specific vulnerability profiles, top misconfigurations, and average remediation timelines.
Cloud adoption has changed how organizations build and run infrastructure, but it has also moved more security decisions into the configuration layer. Seemingly minor configuration settings can create real exposure, from public network access and unrotated keys to missing encryption, exposed services, and logging gaps. Misconfiguration is consistently ranked as one of the top threats to cloud environments, and CISA now mandates baseline cloud configuration practices for U.S. federal agencies.
Security Risks in Multi-Cloud Environments
More than two-thirds of organizations operate multi-cloud environments, inherently complicating cloud security as each provider handles risks differently. The same issues can be surfaced in different ways, described using different terminology, and require a different fix depending on the platform.
Results from Intruder’s 2026 Cloud Security Index reveal that the top misconfigurations across AWS, Azure, and Google Cloud have almost no overlap, making it increasingly difficult for security teams to maintain a consistent security posture across multi-cloud environments. The report groups cloud issues into six categories (weak IAM controls, missing logging and alerting, misconfigured services, permissive firewalls, exposed services, and weak encryption) and compares prevalence across three providers. Key findings include:
- AWS leads in risk exposure: AWS leads in prevalence across five of the six categories. As the largest cloud provider by range of services, it offers the most configuration options, and with that the most opportunities for misconfiguration. The single most common AWS issue is S3 buckets that do not enforce HTTPS, at 87%, followed by permissive ingress to sensitive ports at 84% and IAM policies allowing privilege escalation at 83%.
- Azure storage and Entra ID gaps: Azure’s top three misconfigurations all stem from storage accounts, affecting between 61% and 67% of accounts. More than half of Azure accounts — 55% — contain Entra users without multifactor authentication (MFA).
- Google benefits from secure defaults: Google Cloud has the lowest misconfiguration rates across four categories, including the widest gap in publicly exposed services. Google Cloud also offers the fewest services.
- The gap between providers is stark: 76% of AWS accounts have publicly exposed services, compared to 64% on Azure and just 8% on Google Cloud. Permissive firewalls follow a similar pattern, affecting 83% of AWS accounts versus 45% on Azure and 34% on Google Cloud. For multi-cloud teams, this means security priorities must be set platform by platform.
“There’s a common assumption that moving to the cloud makes you secure by default,” said Chris Wallis, CEO and founder at Intruder. “This data shows the opposite: every platform has different weaknesses, and security teams have to understand and address the specific risks on each one. You can’t just configure once and assume you’re covered.”
Cloud Security Posture by Organization Size
As organizations grow, cloud security posture generally improves. Smaller organizations remediate cloud issues in 8 to 16 days. Remediation slows sharply in the 1,000–5,000 employee range, peaking at 35 days, before improving again at the largest sizes, with 10K+ organizations back down to 10 days.
This mirrors the pattern seen in Intruder’s 2026 Attack Surface Management Index: midmarket organizations face the longest remediation times, likely managing enterprise-level cloud complexity without the dedicated resources to match.
Identity and Access Management Weaknesses
Every provider has different weaknesses, but identity is where they converge. Weak IAM controls affect 87% to 97% of accounts across all three providers. IAM issues dominate Google Cloud’s own top four misconfigurations, with three out of four accounts missing OS Login controls.
IAM is also the only category that worsens steadily as organizations grow: 87% among SMEs, 95% among midmarket organizations, and 98% among large enterprises. Permissive firewalls and weak encryption both decline with size, but logging gaps and misconfigured services peak in the midmarket — the same organizations that take the longest to remediate.
About Intruder’s 2026 Cloud Security Index Intruder’s 2026 Cloud Security Index can be found here.
