Your Cloud Security Checklist Can't Cover Three Clouds

One cloud security checklist cannot cover three clouds.

The platforms you run on fail in different places, and passing on one says almost nothing about the other two.

Intruder's 2026 Cloud Security Index audited 3,000 organizations across AWS, Azure, and Google Cloud. Weak identity controls and missing logging touch 80 to 98 percent of accounts on every platform.

Beyond those two constants, the risk profiles share almost nothing in common.

The checklist that protects you is per provider, built from the failures that platform actually produces.

AWS fails on exposure. Exposed services sit in 76 percent of accounts, 87 percent of S3 buckets skip HTTPS, and 83 percent of accounts carry IAM policies that allow privilege escalation.

In one documented intrusion, exposed credentials reached administrative control in under ten minutes across 19 AWS principals.

Azure fails on storage and identity. Its top three issues are unrotated storage keys at 67 percent, access keys left enabled at 66 percent, and public network access at 61 percent, while 55 percent of accounts keep Entra users without MFA.

Google Cloud looks clean on exposure, with just 8 percent of accounts affected, because secure defaults ship with the platform. Its risks concentrate in identity instead, where 77 percent of accounts run without OS Login MFA and 75 percent keep unused service accounts.

The fix is older than the trend: nothing earns trust just for existing inside your network, which is the discipline in our practical guide to zero trust architecture. Apply that rule per cloud and per account, not per corporate slogan.

Three habits separate the teams that react from the teams that already knew.

1. Run provider specific checks, not generic ones. AWS demands you hunt exposure first, so scan for public S3 buckets, permissive network ACLs, and escalation paths before anything else, because a single overprivileged policy can undo every other control you hardened. Test your AWS instincts against reality with the free AWS solutions architecture check.
2. Treat Azure storage and identity as one surface. The top three Azure mistakes all live in storage accounts, and the same directory that guards them also protects your Microsoft 365 and SaaS apps, so rotate keys, close public endpoints, and put MFA on every Entra user, not just the admins.
3. Fix Google Cloud at the identity layer first. Enforce OS Login with MFA, delete dormant service accounts, and trim overly permissive roles, because identity risk grows with company size and weak IAM now affects 98 percent of large enterprises. Check how well you actually understand access control with the authentication and authorization competence check.

The old game asked whether you passed the checklist. The new game asks whether you checked the right platform.

Wondering which of the three lists describes your estate? Take the free five minute cloud security competence check and get a verifiable receipt instead of a guess.

Question for you: if each provider fails differently, which five settings on your busiest cloud would you bet are already wrong?

<small>Report data: Intruder's 2026 Cloud Security Index, covered by The Hacker News, with the AWS intrusion described in Dark Reading. Featured graphic courtesy of Intruder. Server photos via Wikimedia Commons: Carl Lender, CC BY 2.0, and Visitor7, CC BY SA 3.0.</small>