Cloud Misconfigurations Differ Wildly Across AWS, Azure, and GCP

New research from Intruder's 2026 Cloud Security Index reveals that cloud security risk profiles vary dramatically across providers, undermining the assumption that a single cloud security checklist works universally. Analyzing misconfiguration data from 3,000 organizations, the study found that while weak identity and access management (IAM) controls and missing logging are near-universal problems affecting 80% to 98% of accounts regardless of provider, the remaining categories diverge sharply. Exposed services affect 76% of AWS accounts compared to just 8% on Google Cloud, while permissive firewalls impact 83% of AWS environments versus 34% on GCP. Azure stands out as the worst offender for misconfigured services at 80%, outpacing both competitors.

The most common AWS misconfigurations include S3 buckets that do not enforce HTTPS (87% of accounts), permissive ingress to sensitive ports via network ACLs (84%), overly permissive network ACLs (83%), and IAM policies that allow privilege escalation (83%). In one recent incident, an attacker leveraged exposed credentials to escalate to administrative privileges in under 10 minutes, compromising 19 AWS principals, demonstrating how easily IAM complexity can be weaponized. Organizations concerned about their own network exposure can run a port scanner to identify inadvertently open services, or use an SSL/TLS checker to verify that their storage endpoints enforce encrypted connections.

AWS leads in prevalence across five of the six misconfiguration categories, likely due to its broader service catalog creating more configuration surface area. Google Cloud, which offers the fewest services and ships more secure defaults through its Shared Fate model, scored lowest in five categories. Encryption weaknesses further illustrate the gap: 49% of AWS accounts, 35% of Azure accounts, and only 8% of GCP accounts showed weak encryption configurations. This disparity suggests that "best practices" checklists from one provider rarely transfer cleanly to another.

For security teams operating in multi-cloud environments, the findings underscore the need for provider-specific hardening rather than generic frameworks. Weak credentials remain a common entry point, making it essential to audit accounts with a password checker and enforce strong IAM policies tailored to each platform's unique risk landscape. The data makes one thing clear: cloud security is not one-size-fits-all, and treating it as such leaves measurable gaps.