2026云计算核心威胁调查报告 Top Threats to Cloud Computing 2026

cloud

alliance®

CSAsecurity

TopThreats

WorkingGroup

SurveyReport

TopThreatsto

CloudComputing

2026

ThepermanentandofficiallocationfortheTopThreatsWorkingGroupis/research/working-groups/top-threats

©2026CloudSecurityAlliance–AllRightsReserved.Youmaydownload,store,displayonyour

computer,view,print,andlinktotheCloudSecurityAllianceatsubjecttothefollowing:(a)thedraftmaybeusedsolelyforyourpersonal,informational,non-commercialuse;(b)thedraftmaynotbemodifiedoralteredinanyway;(c)thedraftmaynotberedistributed;and

(d)thetrademark,copyrightorothernoticesmaynotberemoved.YoumayquoteportionsofthedraftaspermittedbytheFairUseprovisionsoftheUnitedStatesCopyrightAct,providedthatyouattributetheportionstotheCloudSecurityAlliance.

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.2

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.3

Acknowledgments

TheTopThreatsWorkingGroupaimstoprovideorganizationswithanup-to-date,expert-informedunderstandingofcloudsecurityrisks,threats,andvulnerabilitiesinordertomakeeducatedrisk-managementdecisionsregardingcloudadoptionstrategies.

CO-CHAIRS

VicHargrave

MichaelRoza

Jon-MichaelBrookAlexGetsin

REVIEWERS

RavindraAnnam

SrinivasuBongu

HarithGaddamanuguMatthieuGaillard-MidolNiharKalyanam

ShantanuSavant

GauravVikramSinghNishanthSirikonda

ChrisPepper

CSAGLOBALSTAFF

AndyRuth

StephenSmithStephenLumpe

CONTRIBUTORS

AnnunayBhatt

Jon-MichaelBrookRandallBrooks

HilaryChan

ScottFuhriman

VicHargrave

SathishHolla

MichaelMorgenstern

MichaelRoza

MarkSzalkiewiczOrenYeger

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.4

TableofContents

Acknowledgments 3

ExecutiveSummary 5

TheSurvey 8

MeettheTopThreats 10

SecurityIssue01:InadequateIdentityandAccessManagement 12

SecurityIssue02:AI-EnhancedAttacks 18

SecurityIssue03:InsecureThird-PartyResources 26

SecurityIssue04:InsecureInterfacesandAPIs 33

SecurityIssue05:MisconfigurationandInadequateChangeControl 40

SecurityIssue06:AISystemCompromise 47

SecurityIssue07:AdvancedPersistentThreats 54

SecurityIssue08:LackingCloudSecurityStrategyandGovernance 60

SecurityIssue09:InsecureSoftwareDevelopment 68

SecurityIssue10:AccidentalCloudDataExposure 73

SecurityIssue11:SystemVulnerabilities 79

ConclusionandFutureOutlook 85

Appendix1:Technical/BusinessImpactsandKeyTakeawaySectionsContent 87

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.5

ExecutiveSummary

TheTopThreatstoCloudComputingSurveyReport2026showadecisivechangeincloudsecuritypriorities.Identity,artificialintelligence,third-partyresources,andAPIsnowdominatethecloud

threatlandscape;whiletraditionalinfrastructureconcernscontinuetodeclineinrelativeimportance.Mostnotably,twonewAI-relatedissues,AI-EnhancedAttacksandAISystemCompromise,enteredtheTopThreatsrankingsinsecondandsixthplace,respectively,highlightingthegrowinginfluenceofAIonbothattackmethodsanddefensivestrategies.AlthoughbothissuesinvolveAI,theyaddressdifferentrisks:AI-EnhancedAttacksfocusesontheuseofAItoimproveorautomateattacks,whileAISystemCompromisefocusesonAIsystemsthemselvesasassetsthatcanbecompromised,

manipulated,orabused.ThisTopThreatsreportaimstoraiseawarenessofcloudthreats,vulnerabilities,andrisks.

Forthisinstallmentwesurveyed507industryexpertsonsecurityissuesinthecloudindustry.Ourrespondentsidentified11importantsecurityissuesintheircloudenvironmentsthisyear.TheTop

ThreatsWorkingGroupusedthesurveyresultsanditsexpertisetocreatethe“TopThreatstoCloudComputing2026”report.

Rank

2026

2024

1

InadequateIdentityandAccessManagement

(Identity&AccessManagementin2024survey)

Misconfiguration&InadequateChangeControl

2

AI(ArtificialIntelligence)-EnhancedAttacks(newin2026)

Identity&AccessManagement

3

InsecureThird-PartyResources

InsecureInterfacesandAPIs

4

InsecureInterfacesandAPIs

InadequateSelection/ImplementationofCloudSecurityStrategy

5

Misconfiguration&InadequateChangeControl

InsecureThird-PartyResources

6

AISystemCompromise(newin2026)

InsecureSoftwareDevelopment

7

AdvancedPersistentThreats

AccidentalCloudDisclosure

8

LackingCloudSecurityStrategy&Governance(InadequateSelection/ImplementationofCloudSecurityStrategyin2024survey)

SystemVulnerabilities

9

InsecureSoftwareDevelopment

LimitedCloudVisibility/Observability

10

AccidentalCloudDataDisclosure

UnauthenticatedResourceSharing

11

SystemVulnerabilities

AdvancedPersistentThreats

Note:Therankingsshownfor2026and2024representtherelativepositionofeachsecurityissueintherespectivesurveyyear.Entriesappearingonthesamerowarenotdirectone-to-onemappingsbetweenyears.

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.6

OBSERVATIONS

The2026surveyresultsshowidentity,AI,softwaresupplychains,andinterconnectedcloud

ecosystemsdisplacingtraditionalinfrastructureastheprimarysecurityconcerns.IssuestiedtotheunderlyingcloudinfrastructureandcloudserviceprovidersrankedbelowtheTop11thisyear.Issuessuchasdenial-of-serviceattacks,sharedtechnologyvulnerabilities,CSPdataloss,Unauthenticated

ResourceSharing,andLimitedCloudVisibility/ObservabilitywerealsoratedbelowtheTop11thisyear.

Themostnotabledevelopmentinthe2026resultswastheemergenceofAIasbothanenablerofattacksandatarget.AI-EnhancedAttacksandAISystemCompromiseenteredtherankingsatsecondandsixthplace,respectively,reflectinggrowingconcernabouttheimpactofAIoncloudsecurity.AIisnotanemergingconcern—itisthecurrentone.Autonomousagents,multi-agentsystems,andMCP-basedintegrationsareintroducingattacksurfacesthatmostcloudsecurityprogramswerenotbuilttoaddress.

Severalthemesemergedfromthesurveyresults:

•InadequateIdentityandAccessManagement(IAM):IAMrankedfirstin2026.Respondentshighlightedreplayattacks,impersonation,excessivepermissions,non-humanidentities,

poorlymanagedcertificatesandcryptographickeys,andexcessivetrustinfederated

relationships.ThecontinuedadoptionofZeroTrustapproachesreflectsthecentralrolewhichidentitynowplaysincloudsecurity.

•AI-EnhancedAttacks:Thisnewissueenteredtherankingsinsecondplace.Respondents

expressedconcernthatattackersareusingAItoimprovephishing,reconnaissance,malwaredevelopment,socialengineering,vulnerabilitydiscovery,andattackautomation.AIis

loweringthebarriertoentryforattackers,whilemakingtheiractivityhardertodistinguishfromlegitimatebehavior.ThecapabilitiesofMythosandsimilarsystems,wherecurrentlydiscoveryspeedoutpacesremediation,havecontributeddramaticallytothisthreat.

•InsecureThird-PartyResources:Third-partyriskrosetothirdplace,reflectinggrowing

dependenceonSaaSproviders,softwarepackages,externalAPIs,AImodels,managed

services,andcloudmarketplaces.Thirdplacemeansorganizationsarediscoveringthisrisktoolate.Theyarelosinggroundtoit.

•InsecureInterfacesandAPIs:APIsandinterfacesrankedfourthascloud-native

architectures,microservices,andAPI-drivenintegrationscontinuetoexpand.Weak

authentication,excessivepermissions,insecureAPIdesign,andinadequatemonitoringremaincommonsourcesofexposure.

•MisconfigurationandInadequateChangeControl:MisconfigurationremainedintheTop

5despiteyearsofawareness.Multi-cloudenvironments,infrastructure-as-code(IaC),Kubernetes,serverlessfunctions,AIservices,andincreasingautomationcontinuetoincreaseconfigurationcomplexityandthelikelihoodoferror.

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.7

•AISystemCompromise:Thisnewissueenteredtherankingsinsixthplace.Respondents

expressedconcernthatAIsystemsthemselveshavebecomeattacktargets.Threatssuchaspromptinjection,modeltheft,datapoisoning,insecureAIintegrations,agentcompromise,andattacksagainsttrainingandinferenceenvironmentsarenotvariationsofknowncloudrisks.Mostcloudsecurityprogramshavenocontrolsspecificallydesignedforanyofthem.

•LackingCloudSecurityStrategyandGovernance:Theenvironmentsorganizationsaretryingtogovernin2026bearlittleresemblancetotheonestheirgovernanceframeworksweredesignedfor.

The2026resultsmaketheprioritiesclear:identity,AI,third-partyecosystems,andAPIs.Everythingelseisbringinguptherear.

TARGETAUDIENCE

Thisreportisdesignedtosupportsecurityprogramplanning,riskprioritization,andgovernance

investmentdecisionsacrosscloudandAIenvironments.Thissurvey-basedresearchalsoprovidescompliance,risk,technology,andinformationsecuritystaff,aswellasexecutivemanagement,withinsightsintocurrenttechnologytrendsandhigh-prioritycloudsecurityconsiderations.

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.8

TheSurvey

Whencreatingthe“TopThreatstoCloudComputing2026”surveyreport,theCSATopThreats

WorkingGroupconductedresearchintwostages.Bothstagesusedsurveystogatherthethoughtsandopinionsofcybersecurityprofessionalsconcerningthemostrelevantthreats,vulnerabilities,andrisksofsecurityissuestocloudcomputing,withtheultimategoalofidentifyingtheTopThreatsfor

2026.Duringthefirststagethegroupcreatedashortlistofcloudsecurityissuesthroughanonline

surveyoftheworkinggroup’smembers.Thegroupstartedwiththe11threatsfromtheprevious

report,TopThreatstoCloudComputing2024,andadded12newissuesthroughdiscussion.The

groupthenreviewedthe23issuesinaseriesofmeetings,askingworkinggroupmemberstoindicatetheimportanceofeachissuetotheirorganizationsandotherfamiliarorganizations.These23issueswerepresentedinthesurvey.

Duringthesecondstageoftheresearch,thegroup’smaingoalwastorankbyimportancethelist

of23securityissues,basedonanonlinesurveyof507securityprofessionals.Thegroupchosea

10-pointslidingscaletoreflecttheimportanceofeachissue.Thesurveyparticipantswereinstructedtorateeachissueonascaleof1to10,with1being“Notveryimportant”and10being“Most

important.”Thepointsforeachcategoryweretotaledandaveraged.Thesecurityissueswere

thenrankedaccordingtotheirmeanscore.TheworkinggroupusedthesescorestoarriveattheprioritizedTop11Threatsbelow.

SurveyResultsRank

SurveyAverageScore

IssueName

1

7.95

InadequateIdentityandAccessManagement

2

7.91

AI-EnhancedAttacks

3

7.85

InsecureThird-PartyResources

4

7.83

InsecureInterfacesandAPIs

5

7.77

MisconfigurationandInadequateChangeControl

6

7.71

AISystemCompromise

7

7.66

AdvancedPersistentThreats

8

7.64

LackingCloudSecurityStrategy&Governance

9

7.56

InsecureSoftwareDevelopment

10

7.48

AccidentalCloudDataDisclosure

11

7.45

SystemVulnerabilities

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.9

Withthe11TopThreatsidentifiedandordered,theworkinggroupanalyzedeachissue.Eachanalysisdescribes:

A.Theissue

B.Technicalimpacts

C.Businessimpacts

D.Keytakeaways

E.Anecdotes,usingreal-worldexamples

F.ReferencetotherelevantsectionofCSA’sSecurityGuidanceforCriticalAreasofFocusinCloud

G.Computingv5domainguides,and

H.TherelevantmitigatingcontrolsinCSA’sArtificialIntelligenceCloudControlsMatrixv1.1(AICM)

Finally,theoverallmethodologyalignswiththeTopThreatsmethodologypresentedinAppendix1:Technical/BusinessImpactsandKeyTakeawaySectionsContent.

MEETTHETOPTHREATS

⑥sECURITYISSUEO1

InadequatoldentisyandAccessManagemen

InadequateIAMstemsfrommisconfiguredtrustrelationships,weak

credentials,andsprawlingmachineidentities,lettingattackersslippast

authenticationundetected.UnifyingIAMtoolingandenforcingleastprivilegeremaintheprimarydefenses.

①sECURITYISSUEO2

Al-EnhancedAttacks

Al-enhancedattacksexploitmisconfiguredcontrolsandexposed

managementplanestoidentifyandweaponizevulnerabilitiesatmachine

speed.Attackershaveweaponizednewlypublishedflawsinunder22minutes.

```markdown```

⑨sECURITYISSUEO3

InsecureThird-PartyResources

Insecurethird-partyresourcesspanSaaStools,APls,andCI/CDpipelines,

Managingthisexposure,knownasC-SCRM,isnowaboard-levelconcern.

题

SECURITYISSUEO4

InsegureThird-ParsyAPI

InsecureinterfacesandAPlsarisefrombrokenauthenticationandpoorly

governedmachineidentitiessuchasAPIkeysandtokens,whichcaused52%

SECURITYISSUEO5

MisconfigurationandInadequateChangeControl

Misconfigurationstemsfromweakchangecontrol,excessivepermissions,

andthinlogging,andoftengoesundetecteduntilabreachforcesreview.It

caused29.4%ofthisyear'scloudaccessbreaches.

```markdown```

SECURITYISSUEO6

①sECURITYISSUEO7

AdvancedPersistentThreats

AdvancedPersistentThreatsaresustained,oftenstate-sponsoredcampaigns

2026,theactorSapphireSleetcompromisedannpmpackagetoharvestdevelopercredentials.

①SECURITYISSUEO8

LackingCloudSecurityStrategyandG

Alackingcloudsecuritystrategyleavesidentities,dataflows,andAltools

ungoverned,lettingadoptionoutpacethevisibilityneededtomanageit.

Machineidentitiesnowoutnumberhumanones100to1.

3

◎sECURITYISSUEO9

InsecureSoftwareDevelopment

Insecuresoftwaredevelopmentstemsfromweakcodingpracticesand

overprivilegedautomationidentities,exposingcredentialsthatletattackersreachcloudcontrolplanes.HardeningCi/CDtoolingandeliminatinghard-

①sECURITYISSUE10

AccidentalCloudDataExposure

AccidentalclouddataexposurestemsfrommisconfigurationandunauthorizedShadowAluse,withnearlyhalfofclouddatabasesnowpubliclyaccessible.

Mostbreachestracebacktoconveniencewinningoutoversecurity.

①sECURITYISSUE11

SystemVulnerabilities

Systemvulnerabilitiesincloudinfrastructurecompromisedataanddisruptoperations.Commoncausesincludemisconfiguration,zero-days,andweakcredentials.Patchingandmonitoringremainessentialdefenses.

12

①SECURITYISSUEO1

InadequateIdentityandAccess

Management

Identity&AccessManagement(IAM)ensuresonlyauthorizeduserscanaccesstheresourcesthey

needbyprovingwhoorwhattheyclaimtobe.IAMispivotalindefiningandmanaginguserroles,

accessprivileges,andthespecificconditionsunderwhichtheseprivilegesareallocatedorrescinded.Despiteitscriticalrole,IAMpresentsongoingchallengesincybersecurityduetoitscomplexityandtheevolvingnatureofcyberthreats.Keycomponentsincludinguserauthentication,authorization,SingleSign-On(SSO),Multi-FactorAuthentication(MFA),andactivitymonitoringareintegraltoIAMseffectiveness.However,theintricaciesanddynamismofthesefeaturescanintroducevulnerabilities,especiallyifnotimplemented,configured,updated,ormonitoredcorrectly.Ascyberthreats

becomemoresophisticated,securingsensitiveinformationagainstunauthorizedaccessbecomesincreasinglydaunting,makingtherobustimplementationandcontinualrefinementofIAMstrategiesindispensableinfortifyingcybersecuritydefenses.

Managingidentitiesandaccessincloudenvironmentscanbecomplexandrisky.Differentcloud

providershaveuniquesystems,whichcanleadtomistakesandsecuritygaps.Whenuserscreate

andmanagetheiraccountsandresources,thesediscrepanciescanresultinexcessivepermissions

andmisconfiguredsettings,increasingsecurityrisksandleadingtoprivilegesprawl.WithcentralizedIAMsystemmonitoring,issueresponseiseasier,whileinconsistentpoliciesfurthercomplicate

securityefforts.

ThemoderncloudlandscapehasalsoseenanexplosionofNon-Humanldentities(NHls),such

asserviceaccounts,APlkeys,andautomatedbots,whichnowvastlyoutnumberhumanusers.

Unlikehumanidentities,thesemachineidentitiesoftenlackstandardizedlifecyclesandarepronetoover-permissioningtoensurethatautomatedworkflowsrununinterrupted.AlagentshavealsoemergedasamajorcategoryofNHIs.ThisrepresentsashiftintheunderlyingquestionIAMmustanswer.TraditionalIAMaskswhothisentityisbutagenticsystemsrequireaskingwhoseauthority

isbeingexercised,underwhatconstraints,andforhowlong.Anagent’sidentityisnecessarybut

notsufficient.Verifyinganagent’sidentitydoesn’ttellyouwhatitwasactuallyauthorizedtodoonahuman’sbehalf,orwhetherthatauthorizationstillholds.Thereforeorganizationsshouldextend

identitygovernanceprogramstoincludeagentlifecyclemanagement,least-privilegeenforcement,credentialrotation,andcontinuousauthorizationvalidation.Withoutadedicatedstrategytogovernthesemachine-to-machineinteractionsNHIsrepresentamassive,invisibleattacksurface.

Prominentconcernshavehistoricallyrevolvedaroundmisconfiguredtrustrelationships,bypassed

securitycontrols,poorlyenforcedaccesspolicies,andimproperlymanagedorexposedcredentials.Increasingly,cloudcompromisesinvolveabuseoftrustedrelationshipsbetweenidentities,

applicationsandcloudservices—ratherthandirectcredentialcompromise.Asorganizationsexpandthird-partyintegrations,automatedworkflowsandgovernanceoftrustedrelationshipsarebecomingascriticalasauthorizationandauthenticationthemselves.

NHIshaveenabledattackerstoshifttheirtacticsaccordingly.Insteadoftargetingtraditional

passwordsmoderncybercriminalsincreasinglyfocusonstealingactivesessiontokens,hijacking

over-privilegedautomation,andexploitingvulnerabilitiesinmisconfiguredauthenticationflows.Thisunderscoresamajorshiftwheretoday’sthreatsaren’tjustcredentialtheft,concernsareshiftingtotheexploitationofvalidpost-authenticationsessions.OrganizationsmustpivottheirIAMprioritiesfrominitialaccesscontrolstocontinuous,post-trustsessionprotectiontomitigatethistop-tierrisk.

TECHNICALIMPACT

Confidentiality

•SystemAccess&DataDisclosure:Weakauthentication,stolencredentials,excessivepermissions,andmisconfiguredtrustboundariesallowattackerstobypasssecurityperimeters;whichleadstounauthorizedusersgainingaccesstosensitivedata.

•AIandCloudExposure:Misconfiguredstorage,APIs,vectordatabases,orlogging

systems—oftenaccessedviaover-privilegedserviceaccounts—canexposehighlysensitiveinformation.Formoredetail,refertoSecurityIssue10:AccidentalCloudDataExposure.

•Exposureofsecretsandcredentials:Inadequateoperationofidentityobjects,secure

certificates,encryptionkeys,secrets,serviceaccounts,accesstokensandAPIkeysallowunauthorizeduserstoaccessacrosscloudenvironments.

Integrity

•UnauthorizedModification:InconsistentIAMpoliciesandalackofConditionalAccess

enforcementallowattackerstoescalateprivilegesandmanipulatecriticalconfigurations.

•DestructionorCorruptionofData:Improperlycontrolledchangesormisconfiguredworkflowsmaycorruptordestroydatasets,modelartifacts,orcriticalsystemdata;affectingsystemintegrityorrecoverability.

•SystemTrust:Ifanattackermaneuversinanenvironmentwithelevatedprivileges,theycanpermanentlycompromisetheintegrityandrecoverabilityoftheentireenvironment.

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.13

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.14

Availability

•LossofDataorServiceAvailabilityandOperationalOutages:Misconfiguredaccesstoanyaspectorelementintheenvironmentmayresultinunavailability,degradedperformance,oroutagesofcloudorAIdataandservices.

•ServiceDisruption:MismanagedidentitylifecyclesthatbypassZeroTrustcontrolscanbeexploitedtolockoutlegitimateadministratorsorshutdownmission-criticalservices.

•ResourceExhaustion:Overprivilegedidentitiescantriggereventsthatdegradeperformanceorcausecompleteoutagesofcloud-nativeandAIservices.

BUSINESSIMPACT

Operational

•ServiceOutage:Exploitationofoverprivilegedserviceaccountsor“break-glass”credentialscanleadtoapartialorcompleteshutdownofcloudinfrastructureservicesorAIinferencepipelines,disruptingorhaltingcorebusinessoperations.

•FeatureDelay:Featureupdatesmaybedelayedtoremediatesoftwareexploits.

•RemediationDebt:ThediscoveryofpervasiveIAMmisconfiguration(suchasunrotatedkeysorinsecureOIDCtrusts)forcesashiftfrominnovationtoemergencyremediation,resultinginsignificantdelaystoproductroadmapsandfeatureupdates.

Financial

•LostRevenue:Financiallossescanoccurduetoservicedisruption,servicerestoration,customerdissatisfaction,orlegalactionsincludingregulatoryfines&legalcosts.

•Non-compliance:Failuretoadequatelysecureidentityandaccesscontrolscanleadto

non-compliancewithregulatoryrequirementssuchasGDPR,CCPA,andindustry-specificregulationsincludingPCIDSS.

•RegulatoryFines&LegalCosts:InadequatecontroloverNHIoftenleadstonon-compliancewithevolvingmandatessuchasGDPR,CCPA,andAI-specificregulations,whichcantriggerfinesandcostlyclass-actionlitigation.

Compliance

•Regulatory/ComplianceViolations:WeakIAMcontrolsandunsecuredNon-Human

Identitiesviolateglobaldataprotectionmandates,includingGDPRandCCPA.RecurringIAMfailurescastdoubtonanorganization’sabilitytoadheretosecuritystandardssuchasISO/IEC27001,SOC2,andFedRAMP.Theabilitytoachieveorretaintheseauthoritativecertificationsmightbedelayedorforfeited.

•AuditFindings:Identitysprawl,unrotatedkeys,misconfiguredtrust,andmissingaccesspoliciescancausefailedassessments.

•PolicyNon-conformance:Storingplaintextcredentialsandusinglong-livedtokensdirectlyviolatecorporateZeroTrustbaselines.Neglectingleast-privilegeenforcementbreachesinternalgovernancepoliciesandcontractualsecuritySLAswithclientsandpartners.

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.15

Reputational

•CompanyReputation:Damagetotheorganization’spublicimage,business,andbrandvalue.

•CustomerReputation:ClientsrelyingonweaklysecuredAPIcloudservicesmayexperiencedatabreachesandserviceinterruptions,whichcannegativelyimpacttheirreputations.

•DownstreamCustomerFallout:OrganizationsprovidingSaaSorAPI-drivenservicesrisk“collateraldamage”totheirclients.

KEYTAKEAWAYS

•UnifyIAMSolutions:UseIAMsolutionsthatprovidestrongauthentication,centralizedmanagement,andvisibilityacrossmultiplecloudproviders.

•EnforceLeastPrivilegetoLimitImpactScope:Ensureentitieshaveonlytheaccessrightsneededtoperformtheirtasks.Controllingimpactscopehelpsmitigatepotentialbreaches.Rigidlyapplytheprincipleofleastprivilegetobothhumanandautomatedworkloads.

Eliminating“privilegesprawl”andover-permissionedautomationisthemosteffectivewaytopreventminorcompromisesfrombecomingsystemicoutagesormassdataexfiltrations.

•UnifiedLifecycleandActivityMonitoring:Implementautomatedtoolstomanagethefullidentitylifecycle—fromprovisioningtodeprovisioning—whilemaintainingreal-timevisibilityacrosshybridcloudenvironmentstoevaluateaccessrightsanddetectanomaliesbefore

orphanedaccountsorunauthorizedattemptsbecomepersistentbackdoors.

•PrioritizeNon-HumanIdentity(NHI)Governance:Shiftfocusbeyondhumanuserstothelargerattacksurfaceofmachineidentities.Organizationsshouldestablishclearownershipandaccountabilityfornon-humanidentitiesthroughouttheirlifecycles—includingperiodicaccessreview,privilegevalidation,credentialrotation,andretirementofunusedidentities.Withoutactivegovernancemachineidentitiesoftenaccumulateexcessivepermissionsandbecomedifficulttomonitoratscale.

•HardenAuthenticationBeyondPasswords:Attackershavepivotedtotargetingtokensandmisconfiguredtrustboundaries(OAuth/OIDC).Mitigatethisbydeployingphishing-resistantMFA,sessionbinding,andcontinuoustokenreplayprotection.

•GovernEmergencyAccessandEliminateSecretExposure:Reducerelianceonstatic

credentialsandaccountsthatbypassZeroTrustcontrols.Movesecretsoutofnon-secure

locations(suchasenvironmentvariables)intocentralized,monitoredvaultswithautomatedrotation.Emergency/break-glassaccountsshouldrequireMFA,betightlyscoped,betime-bound,becheckedoutviaapproval,andalertonuse.

©Copyright2026,CloudSecurityAlliance.Allrightsreserved.16

ANECDOTESANDEXAMPLES

Herearesomerecentexamplesofthissecurityissuecausingcloudincidents:

•(April2026)VercelOAuthpivotandenvironment-variableexposure:Attackersabuseda

compromisedthird-partyOAuthapptoaccessaVercelemployeeaccount,thenenumeratedenvironmentvariablesthatwerenottreatedassecretsbydefault.Severalteamshadstoredcloudprovidercredentialsinthosevariables,enablingpotentialdownstreamaccessto

customercloudandSaaSresources[1][2][3].

•(September2025)BRICKSTORMcampaigntargetingserviceproviders:Anespionage

campaigntargetinglegal,SaaS,and