Cloud Security Posture: Gaps Attackers Still Find

Every cloud estate we assess has one. A storage bucket opened to the public for a demo fourteen months ago, by someone who left in the spring. A service account with administrator rights because a deployment was urgent in 2024 and nobody circled back. An IP address still attached to a workload that was retired two re-orgs ago. Nothing about these is sophisticated. They are just still there.

That is the real shape of cloud risk. Breach write-ups love the phrase "advanced attacker", but the entry point is usually a gap that had been sitting in plain sight long enough to become furniture.

Attackers walk paths, not dashboards

Posture tools will happily hand you four hundred findings sorted by severity, and teams dutifully burn sprints working down the list. The problem is that severity scores rate findings in isolation, and attackers do not experience your cloud in isolation. They chain things: an exposed asset, then a credential lying nearby, then a role that can assume a better role, then the data.

So a medium finding on an internet-facing workload can matter far more than a critical buried three network hops deep. The question that cuts through the noise is not "what is rated highest" but "starting from the internet, what can be reached, and from there, what can be escalated". Work through that question honestly for your three most important data stores and you will usually find two or three paths that matter more than everything else on the dashboard combined.

Identity is the posture

In the cloud, the network perimeter is mostly gone and identity took its job. This is where estates drift worst, because permissions only ever accrete. Roles get broadened to unblock a launch and never narrowed. Machine identities pile up, each with credentials that never expire and permissions nobody reviews.

The good news is that the providers now tell you most of this for free. Access analyzers flag resources shared outside the account. Last-accessed data shows which permissions a role actually uses versus what it was granted:

# What has this role touched in the last 90 days, versus what can it do?
aws iam generate-service-last-accessed-details --arn arn:aws:iam::ACCOUNT:role/deploy-role
aws accessanalyzer list-findings --analyzer-name org-analyzer

The gap between granted and used is your risk surface, and shrinking it is unglamorous work that pays better than almost anything else in cloud security.

The gap between collecting and noticing

Most organizations technically log everything. Far fewer would notice a quiet attacker, because collecting telemetry and operating detection are different jobs, and the second one is often nobody's job. The cloud team assumes the SOC watches the logs. The SOC assumes the cloud team would recognize what is abnormal. The attacker operates in the space between those assumptions.

There is a simple, slightly rude test: perform a harmless but suspicious action in your own estate. Create an access key on a dormant admin account, or share a snapshot to an external account, then wait. If no human contacts you within a day, you have your finding, and it outranks everything on the CSPM dashboard.

Restores are the only backup metric

Ransomware crews now target cloud backups and snapshots explicitly, deleting them before encrypting anything. Two questions matter: can your backups be deleted with the same credentials that run production, and have you actually restored from them recently? If backups live in the same account with the same access, they are not a recovery plan, they are a convenience feature. Cross-account copies with separate credentials, and a timed restore drill, turn them back into a plan.

If you only do one thing this week

Pick your single most important data store and trace every path to it from the internet: through what identities, with what permissions, logged where. One store, done honestly, teaches you more about your posture than a quarter of dashboard triage.

If this is on your plate, TecLeads does exactly this as part of our Cybersecurity work. If you'd like a second pair of eyes on your setup, book a 30-minute call or explore what we do.