Managing security across diverse cloud infrastructures is a formidable task, compounded by the unique failure modes inherent to each provider. The **2026 Cloud Security Index** by **Intruder** analyzed misconfiguration data from 3,000 organizations using **AWS**, **Azure**, and **Google Cloud**, uncovering vastly different risk landscapes. ## How Risk Differs Across Cloud Providers **Intruder** categorized misconfigurations into six groups: weak Identity and Access Management (IAM), missing logging, misconfigured services, permissive firewalls, exposed services, and weak encryption. While weak IAM controls and missing logging are nearly universal across all providers (affecting 80% to 98% of accounts), other categories show significant divergence: * **Exposed services**: **AWS** (**76%**), **Azure** (**64%**), **Google Cloud** (**8%**) * **Permissive firewalls**: **AWS** (**83%**), **Azure** (**45%**), **Google Cloud** (**34%**) * **Weak encryption**: **AWS** (**49%**), **Azure** (**35%**), **Google Cloud** (**8%**) * **Misconfigured services**: **AWS** (**68%**), **Azure** (**80%**), **Google Cloud** (**37%**) The most striking difference is in exposed services, with **AWS** at 76% compared to **Google Cloud**'s 8%. **AWS** generally leads in prevalence across five of the six categories, potentially due to its broader range of services offering more configuration points and thus more opportunities for misconfiguration. **Google Cloud**, conversely, has the lowest prevalence in five categories. This could be attributed to its fewer services and a **Shared Fate** model that often provides more secure defaults, especially regarding network exposure and encryption. ## Platform-Specific Misconfigurations ### AWS: Firewalls and Encryption Common misconfigurations on **AWS** accounts include: 1. **S3 Does Not Enforce HTTPS** — **87%** 2. **Permissive Ingress to Sensitive Ports (via ACL)** — **84%** 3. **Overly Permissive Network ACL** — **83%** 4. **IAM Policy Allows Privilege Escalation** — **83%** 5. **VPC Endpoint Not Enabled for EC2** — **82%** The high prevalence of **S3** buckets not enforcing HTTPS is notable, given **S3**'s widespread use. Furthermore, complex **AWS IAM** policies leading to privilege escalation remain a critical concern, as evidenced by recent incidents where attackers gained administrative access in minutes. ### Azure: Storage and Identity On **Azure**, the most frequent misconfigurations are: 1. **Storage Account Key Rotation Not Enabled** — **67%** 2. **Storage Account Access Keys Enabled** — **66%** 3. **Storage Account Public Network Access Enabled** — **61%** 4. **Entra User Without MFA** — **55%** 5. **Trusted Launch Not Enabled** — **45%** The top three issues relate to **Azure Storage Accounts**, often containing sensitive data. The significant number of **Entra ID** users without Multi-Factor Authentication (MFA) is particularly concerning, as **Entra ID** governs access across **Microsoft 365**, third-party SaaS, and on-premises systems. The **2024 Midnight Blizzard** breach, for instance, started with a password spray attack against a legacy account lacking MFA. ### Google Cloud: IAM Dominance **Google Cloud**'s top issues are predominantly **IAM** related: 1. **OS Login MFA Not Enabled** — **77%** 2. **OS Login Not Enabled** — **76%** 3. **Unused Service Account** — **75%** 4. **Overly Permissive Service Account** — **53%** 5. **Permissive Ingress to Sensitive Ports** — **34%** More than three-quarters of accounts are missing **OS Login** controls, which offer a more secure alternative to traditional SSH. ## Impact of Organizational Size Generally, misconfiguration prevalence decreases as organizations grow, with larger enterprises showing fewer permissive firewalls, exposed services, or weak encryption. However, **IAM** is a critical exception: * **SMEs** (under 250 employees): **87%** with weak IAM * **Midmarket** (251–10K employees): **95%** with weak IAM * **Large Enterprises** (10K-100K+ employees): **98%** with weak IAM This trend is alarming, as a single overprivileged identity can compromise otherwise hardened controls. Midmarket organizations also face the longest remediation times, averaging 35 days, suggesting they contend with enterprise-level complexity without commensurate resources. ## Implications for Security Teams For security teams managing multi-cloud environments, the challenge lies in consistently assessing posture across providers while retaining the platform-specific detail necessary for effective remediation. Prioritizing risks and allocating limited resources effectively requires a unified, yet granular, approach to cloud security posture management. The full report, including the top 10 misconfigurations per platform and cloud security posture by organization size, is available in **Intruder**’s **2026 Cloud Security Index**.