What are cloud security issues?
Cloud security issues are the vulnerabilities, attack vectors, and operational gaps that put cloud-hosted data, applications, and infrastructure at risk, ranging from a single misconfigured storage bucket to sophisticated supply-chain attacks that move laterally across services. They generally fall into three categories: risks (conditions like weak configurations or excessive permissions that increase the likelihood of a breach), threats (deliberate malicious actions like account hijacking or malware injection), and challenges (organizational hurdles like compliance complexity or a skills shortage).
Understanding which category an issue belongs to is the first step toward the right response, whether that's a preventive control, active defense, or a process change. The shared responsibility model underpins all three: cloud providers secure the underlying infrastructure, but you own your data, configurations, identities, and access policies.
Cloud security issues: risks vs. threats vs. challenges
Cloud security issues fall into three distinct categories: risks, threats, and challenges. Each requires a different response strategy, from preventive controls to incident response to organizational change.
Cloud security risks are conditions or weaknesses in your environment that increase the likelihood of a breach, such as misconfigurations, excessive permissions, or unencrypted data stores.
Cloud security threats are deliberate malicious actions, either internal or external, that aim to exploit a cloud vulnerability.
Cloud security challenges are the operational difficulties and complexities that organizations face while implementing and managing effective security in cloud environments, from regulatory compliance to multi-cloud sprawl.
Watch 12-min demo
Don't let 17+ different risk types overwhelm your team. Watch how Wiz uses a Security Graph to prioritize the "toxic combinations" that pose the greatest threat to your data.
Top cloud security risks
The most common cloud security risks create conditions that attackers actively seek out. Here are the seven that appear most frequently in real-world breaches:
Data breaches
Inadequate identity access management (IAM)
Insecure APIs
Insufficient cloud configuration management
Shared infrastructure vulnerabilities
Shadow IT
Human error
1. Data breaches
Data breaches occur when unauthorized parties access sensitive information stored in cloud environments, including personally identifiable information (PII) and health records. Because cloud infrastructure centralizes large volumes of high-value data, a single breach can expose millions of records simultaneously. According to IBM, the global average cost of a data breach fell to $4.44 million in 2025 — the first decline in five years, driven by faster, AI-assisted detection.
Breaches can stem from weak authentication, misconfigured permissions, insider threats, social engineering, or ransomware. The downstream consequences range from regulatory fines and legal action to lasting reputational damage.
Example
In December 2025, security researchers found that WorkComposer, an employee-monitoring platform, had left a backend Amazon S3 bucket unsecured, exposing roughly 21 million employee screenshots that potentially captured login screens, internal tools, and confidential documents.
According to the Wiz Cloud Data Security Snapshot, 54% of cloud environments have exposed VMs containing sensitive information, reinforcing the scale of data breach risk.
Key mitigation
Deploy data loss prevention (DLP) tools to monitor and block unauthorized transfers of sensitive information, and classify data by sensitivity so your highest-value stores get the tightest controls.
Take the Cloud Security Self-Assessment
Get a quick gauge of cloudsec posture to assess your security posture across 9 focus areas and see where you can do better.
Begin assessment
2. Inadequate identity access management (IAM)
Identity and access management (IAM) controls which users can access which cloud resources. When IAM policies are misconfigured, overly permissive, or lack role-based access control, attackers can exploit these gaps to reach sensitive data and systems.
Excessive permissions and weak authentication mechanisms turn IAM into a silent attack vector. In practice, this means a single over-privileged service account can give an attacker the same reach as a cloud administrator.
Example
In 2023, Wiz Research found that Microsoft AI researchers had accidentally exposed 38TB of internal data — including secrets, private keys, and 30,000+ internal messages — through a single overly permissive access token. The token was scoped to the entire storage account with full-control permissions instead of read-only access to a few files.
Key mitigation
Eliminate dormant and over-privileged service accounts, adopt just-in-time access so standing credentials don't accumulate, and reconcile human and non-human identities across every provider.
3. Insecure APIs
APIs are the connective tissue of cloud services, handling everything from data exchange to resource provisioning. Insecure APIs can expose sensitive data, enable account takeovers, and disrupt services when attackers exploit weak authentication or overly broad access scopes.
The risk grows as organizations integrate more third-party services. Each new API endpoint is a potential entry point that needs proper authorization, rate limiting, and encryption.
Example
In June 2025, security researchers found that McDonald's McHire recruitment platform, built by Paradox.ai, exposed the personal information of roughly 64 million job applicants. A dormant administrator account secured only with the password "123456," combined with an insecure direct object reference (IDOR) flaw in the platform's API, allowed access to applicant chat histories, contact details, and employment records.
Key mitigation
Enforce strong API authorization mechanisms like OAuth, require security assessments before integrating any third-party API, and apply rate limiting and schema validation to every endpoint.
4. Insufficient cloud configuration management
Misconfigurations in cloud infrastructure create vulnerabilities that attackers can exploit to gain unauthorized access and disrupt operations. Errors in firewall rules, IAM policies, or storage permissions can inadvertently expose sensitive data or grant undue privileges.
Wiz research found that 72% of cloud environments have publicly exposed PaaS databases lacking sufficient access controls, showing the real-world scale of misconfiguration risk.
Configuration drift is especially dangerous in fast-moving environments where infrastructure changes daily. Without automation and continuous monitoring, misconfigurations can persist for weeks before anyone notices.
Example
In December 2025, an Azure Blob storage container belonging to HR tech platform TalentHook was left publicly accessible without proper access controls, exposing approximately 26 million resumes and CVs containing names, emails, phone numbers, and employment history.
Key mitigation
Follow cloud security best practices to catch configuration drift with policy-as-code guardrails that block non-compliant changes before deployment, and use posture management to continuously flag risky settings.
5. Shared infrastructure vulnerabilities
Public cloud environments share physical hardware among multiple tenants. Vulnerabilities in this shared infrastructure can potentially expose all tenants to data leaks or breaches, making strong isolation and segmentation critical.
The interconnected nature of cloud infrastructure means a single configuration error at the provider level can cascade across services and affect thousands of customers simultaneously.
Example
In 2021, Wiz Research disclosed ChaosDB, a cross-tenant vulnerability in Azure Cosmos DB that could have let any customer retrieve the access keys to thousands of other tenants' databases without authorization — a clear example of how one flaw in shared cloud infrastructure can break the isolation every tenant depends on.
Key mitigation
Implement tenant isolation mechanisms such as virtual private clouds (VPCs) and network segmentation, keep hypervisors and infrastructure components patched, and encrypt all data in shared storage.
6. Shadow IT
Shadow IT covers any cloud resources or applications running outside the oversight of your security and IT teams. It is a natural byproduct of agile environments where developers spin up services on the fly to move faster.
The problem is not the speed itself but the lack of visibility. Unapproved tools often lack proper security controls, creating blind spots that attackers can exploit without anyone noticing.
Example
In April 2026, cloud infrastructure company Vercel disclosed a breach that traced back to an employee granting an unsanctioned third-party AI productivity tool, Context.ai, unrestricted "Allow All" OAuth access to their corporate Google Workspace. Attackers who had separately compromised a Context.ai employee used the resulting OAuth tokens to take over the Vercel employee's account and move laterally into Vercel's internal systems.
Key mitigation
Use cloud access security brokers (CASBs) to monitor unauthorized cloud usage, establish clear policies for approved services, and give teams a fast, approved path to provision what they need so shadow IT doesn't fill the gap.
7. Human error
Human error remains one of the leading causes of cloud security failures. These mistakes often stem from a lack of unified cloud strategies, inadequate training, or simply the cognitive load of managing complex environments.
Example
In December 2025, a misconfigured Amazon S3 bucket belonging to WebWork, a time-tracking and productivity monitoring service, exposed roughly 13 million stored logs and screenshots due to a straightforward human error in access settings.
Key mitigation
Reduce the blast radius of mistakes with secure-by-default templates that enforce a unified cloud security strategy, and implement automated guardrails to minimize the risk of unauthorized actions.
Top cloud security threats
While risks create the conditions for a breach, threats are the deliberate actions that exploit them. These four cloud security threats appear consistently in incident reports:
Account hijacking
Insider threats
Cloud malware injection
1. Account hijacking
Account hijacking happens when attackers gain unauthorized control of a cloud account, typically through phishing, credential stuffing, or exploiting weak passwords. Once inside, they can manipulate data, launch further attacks, or use the compromised account as a pivot point to access additional cloud resources.
Example
In 2024, attackers ran a large-scale account-takeover campaign against roughly 165 Snowflake customer environments, logging in directly with usernames and passwords harvested by infostealer malware. Because the targeted accounts had no multi-factor authentication, valid credentials alone were enough to get in.
Key mitigation
Add anomaly detection to flag logins from unusual locations or devices, and move toward phishing-resistant authentication like passkeys alongside targeted user training.
2. Denial of service (DoS) attacks
Denial of service (DoS) attacks flood a cloud service with overwhelming traffic, rendering it inaccessible to legitimate users. Distributed variants (DDoS) amplify the impact by coordinating traffic from thousands of sources simultaneously.
Example
In 2020, AWS experienced a DDoS attack exceeding 2.3 terabits per second, one of the largest on record. The attack disrupted services for multiple customers and highlighted the vulnerabilities even major cloud providers face.
Key mitigation
Deploy managed DDoS protection services, implement rate limiting, use load balancers and autoscaling to absorb traffic spikes before they take your services down.
3. Insider threats
Insider threats come from individuals within the organization who have authorized access but misuse it, whether intentionally or through negligence. Current and former employees, contractors, and partners all pose this risk because they already understand the organization's systems and defenses.
Example
In May 2023, two former Tesla employees leaked 100GB of confidential data, including production secrets and personal information of over 75,000 individuals.
Key mitigation
Use user and entity behavior analytics (UEBA) to catch misuse by legitimate accounts, and log and review access to your most sensitive data stores. Wiz data shows that 3% of service accounts with access to sensitive data are accessible by all users, creating exactly the kind of over-permissioned environment insiders exploit.
4. Cloud malware injection
Cloud malware injection occurs when attackers insert malicious code into cloud services, which then spreads to other systems. This can lead to data theft, unauthorized access, and resource hijacking, often by exploiting vulnerabilities in cloud storage, applications, or service configurations.
Example
In 2017, the cryptocurrency mining malware Coinhive was injected into websites through compromised cloud servers. Attackers exploited insecure configurations to use visitors' computing resources for mining without consent.
Key mitigation
Deploy workload-level threat detection, scan container images and functions before deployment, and validate the integrity of code and dependencies in your build pipeline.
Top cloud security challenges
Challenges differ from risks and threats because they are structural and organizational. You cannot patch a skills shortage or automate away regulatory complexity overnight, but understanding these six challenges helps you plan more effectively:
Complex regulatory compliance
Lack of visibility
Lack of cloud security professionals
Cloud data governance
Managing a rapidly evolving attack surface
Multi-cloud security
1. Complex regulatory compliance
Achieving compliance in the cloud is difficult because regulatory requirements vary by geography, industry, and data type. Organizations must ensure their cloud infrastructure meets standards like GDPR, HIPAA, PCI DSS, and SOC 2, and those requirements shift as regulations evolve.
Example
British Airways was fined £20 million in 2020 for GDPR violations after a data breach exposed the personal and financial details of over 400,000 customers. The incident underscored how costly compliance failures can be when customer data protection falls short.
Key mitigation
Map each framework (GDPR, HIPAA, PCI DSS, SOC 2) to specific cloud controls, and use continuous compliance monitoring so drift is caught between formal audits rather than during them.
2. Lack of visibility
A typical cloud environment combines IaaS, SaaS, and PaaS components, often alongside on-premises data centers in hybrid models. The rapid growth of third-party applications, digital identities, and sensitive data stores can lead to cloud sprawl, where you lose track of what is running and where.
Example
In 2023, Toyota disclosed that a cloud misconfiguration had left the vehicle data of about 2.15 million customers publicly accessible for roughly ten years before anyone noticed. Toyota attributed the lapse to gaps in how its data-handling rules were enforced and responded by rolling out continuous monitoring of its cloud configurations.
Key mitigation
Deploy automated asset discovery and maintain a single, centralized inventory across every cloud and account, so nothing runs where you can't see it.
3. Lack of cloud security professionals
The global shortage of cybersecurity talent means many organizations lack the skills to address cloud-native security challenges. Teams become overworked and over-reliant on external resources that may not fully understand their specific environments.
Example
T-Mobile's 2023 data breach compromised the personal information of more than 37 million customers, highlighting the risks that emerge when security teams are understaffed and unable to keep pace with evolving threats.
Key mitigation
Invest in continuous training for existing staff, implement shift-left initiatives so developers catch issues early, and consolidate tooling so a lean team isn't stretched across a dozen consoles. Managed security services can bridge acute gaps.
4. Cloud data governance
Data governance in the cloud is about knowing where your sensitive data lives, how it moves, and who can access it. Crown jewels like PII, PHI, and PCI data need rigorous governance across AWS, GCP, Azure, and any other platforms you use.
Example
In 2024, background-check data broker National Public Data exposed a trove reported at roughly 2.9 billion records — including names, addresses, and Social Security numbers — that it had aggregated with little governance over such sensitive data. The company later filed for bankruptcy amid the fallout.
Key mitigation
Classify data by sensitivity and map where it lives across every provider with data security posture management (DSPM), then establish automated detection mechanisms to identify data exposure incidents quickly.
5. Managing a rapidly evolving attack surface
Cloud computing's greatest strength, single-click scalability, is also its biggest security challenge. Every new virtual machine, serverless function, service identity, and data store expands the attack surface. These assets are prone to overprivileged entitlements, accidental public exposure, weak credentials, and misconfigurations.
Wiz research found that 80% of documented cloud intrusions in 2025 began with vulnerabilities, exposed secrets, or misconfigurations.
Example
In 2022, a single misconfigured Microsoft Azure Blob Storage endpoint left roughly 2.4TB of business data — customer emails, documents, and order details — publicly accessible, and it had been indexed by search engines for months before discovery.
Key mitigation
Continuously inventory new assets as they spin up, and prioritize remediation by real exploitability, the toxic combinations of exposure, vulnerability, and privilege, rather than trying to patch everything at once.
6. Multi-cloud security
Multi-cloud environments improve redundancy and optimize costs, but managing security consistently across AWS, Azure, GCP, and other providers amplifies every challenge. IAM fragmentation, inconsistent policies, and limited cross-platform visibility make it harder to maintain a unified security posture.
Example
Security researchers have tracked the threat group Scattered Spider (UNC3944) moving across AWS, Azure, and Google Cloud within a single intrusion, following identities and trust relationships from one provider to the next. The group exploits inconsistent IAM controls and fragmented visibility to escalate privileges and persist where no single console sees the whole picture.
Key mitigation
Conduct frequent compliance audits, standardize identity and policy with a centralized control plane, and use a single tool that normalizes findings across AWS, Azure, and GCP so you're not reconciling three separate consoles. .
How to address cloud security issues
The 17 risks, threats, and challenges above share common mitigation patterns. Rather than treating each issue in isolation, a consolidated approach helps teams close the most dangerous gaps first. The UK government's 2025 Cyber Security Breaches Survey found that businesses reported a significant increase in temporary loss of access to files or networks, reinforcing the urgency of a proactive approach. Start with these best practices:
Enforce least-privilege IAM: Grant only the permissions each user and service account actually needs. Review and right-size entitlements on a regular cadence.
Require multi-factor authentication (MFA): MFA blocks the majority of credential-based attacks, including phishing and credential stuffing.
Automate configuration management: Use infrastructure as code (IaC) to standardize configurations and prevent drift. Automated scanning catches misconfigurations before they reach production.
Monitor continuously: Real-time monitoring and vulnerability scanning detect exposures as they emerge, rather than during periodic audits.
Automate compliance: Map regulatory frameworks to your cloud controls and use automated tools to track adherence continuously.
Adopt Zero Trust: Verify every access request regardless of origin. Zero Trust limits the blast radius of any single compromised credential or service.
Encrypt data at rest and in transit: Encryption ensures that even if data is exposed, it remains unreadable without the proper keys.
Maintain an incident response plan: Document roles, escalation paths, and response procedures so your team can act fast when a breach occurs.
The shared responsibility model is the foundation for all of these practices. Cloud providers handle infrastructure-level security, but you own the security of your data, identities, configurations, and applications. Treating cloud security as a shared obligation, not a vendor feature, is what separates teams that respond quickly from those that discover breaches months later.
Protect your cloud with Wiz
Cloud security issues span misconfigurations, identity gaps, data exposure, and evolving threats that traditional point solutions struggle to address in isolation. Wiz takes a different approach by connecting all of these risk signals through the Wiz Security Graph, which maps attack paths across the entire cloud estate and surfaces toxic combinations, the critical intersections of vulnerabilities, permissions, and network exposure that represent actual exploitable risk.
Instead of flooding teams with thousands of siloed alerts, Wiz correlates findings from CSPM, CIEM, CWPP, DSPM, and IaC scanning into a single, prioritized view. That means security teams can focus on the exposures that matter most rather than chasing every individual misconfiguration.
As organizations adopt AI workloads, new risk patterns emerge around model endpoints, training data, and AI service permissions. Wiz AI-APP extends the same graph-based context to AI pipelines, discovering shadow AI deployments, detecting misconfigurations in AI services, and identifying attack paths between AI resources and the broader cloud environment.
See how Wiz connects cloud risks, identity gaps, and AI workloads into a single prioritized view so your team can focus on what actually matters.
Watch 12-min demo
Don't let 17+ different risk types overwhelm your team. Watch how Wiz uses a Security Graph to prioritize the "toxic combinations" that pose the greatest threat to your data.