Cloud Security Index 2026 Reveals Divergent Misconfiguration Risks Across AWS, Azure, GCP

Divergent Cloud Security Risks Identified

The 2026 Cloud Security Index by Intruder, based on data from 3,000 organizations, reveals that cloud security misconfiguration risks are not uniform across major providers. The analysis covered AWS, Azure, and Google Cloud, highlighting that each platform presents a distinct risk profile, challenging the effectiveness of generic security checklists.

Key Misconfiguration Categories and Provider Differences

Intruder categorized misconfigurations into six types: weak identity and access management (IAM), missing logging, misconfigured services, permissive firewalls, exposed services, and weak encryption. While weak IAM and missing logging are prevalent across all providers (80-98% of accounts), other categories show significant divergence. For instance, exposed services affect 76% of AWS accounts but only 8% of Google Cloud accounts. Permissive firewalls are found in 83% of AWS accounts, 45% of Azure, and 34% of Google Cloud accounts. Misconfigured services are highest on Azure at 80%, compared to AWS at 68% and Google Cloud at 37%.

Factors Influencing Risk Profiles

The report suggests that AWS's higher prevalence in five out of six categories might be due to its larger range of services, leading to more configuration options and potential for misconfiguration. Conversely, Google Cloud, which offers fewer services, shows the lowest prevalence in five categories. Google Cloud's 'Shared Fate' model, which emphasizes more secure defaults, particularly for network exposure and encryption, is also cited as a potential reason for its lower risk scores.

Specific AWS Misconfigurations

For AWS, common misconfigurations include S3 buckets not enforcing HTTPS (87%), permissive ingress to sensitive ports via ACL (84%), overly permissive network ACLs (83%), IAM policies allowing privilege escalation (83%), and VPC endpoints not enabled for EC2 (82%). The widespread use of S3 makes its misconfiguration a significant issue for many AWS users.