Cloud Security Isn't One Problem. It's Three.

Key points

• Intruder's 2026 Cloud Security Index reviewed misconfiguration data from 3,000 organisations using Amazon Web Services, Azure and Google Cloud.
• Risk profiles across the three providers share almost nothing in common.
• A single security checklist applied across all three providers will miss provider-specific weaknesses.
• Misconfigurations, not clever hacking, remain the most common way attackers break into cloud accounts.
• Security teams running workloads on more than one cloud need separate playbooks for each.

Running a business on the cloud used to mean picking one provider and learning its quirks. Today most companies use two or three at once, which means three sets of settings, three sets of default behaviours, three sets of ways things can quietly go wrong.

A new report from Intruder, the 2026 Cloud Security Index, looked at misconfiguration data from 3,000 organisations. Misconfiguration is a setting left in the wrong position: a storage bucket open to the public internet, a database with no password, an admin account nobody remembers creating.

The finding, first reported by The Hacker News, is blunt. The mistakes companies make on AWS look almost nothing like the ones they make on Azure, which look almost nothing like the ones they make on Google Cloud. The security checklist you built for one provider won't protect you on the others.

Why do the three clouds fail differently?

Each provider makes its own choices about what is switched on by default, how permissions are handed out, and how services talk to each other. Those choices shape which mistakes are easy to make.

On one platform, the risky default might be storage readable by anyone who guesses the address. On another, it might be an identity system handing out more access than the user actually needs, or logging that stays off until you turn it on. None of these are exotic attacks. They're the digital equivalent of leaving a window open, but the windows are in different places on each house.

What does this mean for a company using more than one cloud?

One playbook isn't enough. A team that has mastered AWS's controls can still be caught out the first time it spins up a workload on Azure or Google Cloud, because the muscle memory doesn't transfer. As we reported on 31 August, automated attackers can test thousands of ways into cloud systems in minutes, which makes provider-specific misconfiguration gaps more dangerous, not less.

Intruder's numbers underline a point cloud security specialists have been making for years. The biggest risk in the cloud is rarely a zero-day, meaning a brand-new software flaw the vendor didn't know about. It's a setting somebody forgot to change.

Should ordinary customers worry about this?

Indirectly, yes. When a company leaves a cloud storage bucket open, the data inside, sometimes names or account details, can be scraped by anyone who finds it. Many large data leaks in recent years began exactly this way.

There's nothing a customer can do about a company's cloud settings. But you can limit the damage: use a different password on every site and turn on two-step login where offered. Be sceptical of unexpected emails claiming to be from a service you use, even if they get small details right.

The bigger picture

Cloud providers have spent years adding guardrails and dashboards to nudge customers into safer settings. The Intruder data suggests those nudges work differently on each platform, and unevenly. For security teams, the honest read is that cloud security isn't one skill. It's three, and treating them as one is where the trouble starts.