Report by Intruder
2026 Cloud Security Index: How risk differs across AWS, Azure, and Google Cloud
Key Findings
More than two-thirds of organizations operate multi-cloud environments.
87% of AWS S3 buckets do not enforce HTTPS.
84% of AWS accounts have permissive ingress to sensitive ports.
55% of Azure accounts contain Entra users without multifactor authentication (MFA).
76% of AWS accounts have publicly exposed services, compared to 64% of Azure accounts and 8% of Google Cloud accounts.
Organizations with 1,000–5,000 employees take 35 days to remediate cloud issues.
Weak IAM controls affect 87% to 97% of accounts across AWS, Azure, and Google Cloud.
75% of Google Cloud accounts are missing OS Login controls.
IAM weaknesses occur in 87% of SMEs, 95% of midmarket organizations, and 98% of large enterprises.
AWS leads in prevalence across five of the six misconfiguration categories.
83% of AWS accounts have IAM policies that allow privilege escalation.
Smaller organizations remediate cloud issues in 8 to 16 days.
Azure's top three misconfigurations affect between 61% and 67% of Azure accounts.
Permissive firewalls affect 83% of AWS accounts, 45% of Azure accounts, and 34% of Google Cloud accounts.
Organizations with 10,000+ employees remediate cloud issues in 10 days.