Cloud reconnaissance is the process attackers use to map cloud assets, permissions, identities, and exposed services before launching a deeper attack. It often signals early-stage intrusion activity. Effective detection depends on correlating identity events, API behaviour, and workload actions across environments to identify suspicious discovery patterns.
Expanded Definition
Cloud reconnaissance is the discovery phase of an intrusion in which an actor inventories cloud accounts, identities, roles, APIs, storage, and exposed services to determine what can be reached and how controls are enforced. In NHI and IAM contexts, the target is often not just infrastructure but the trust fabric around service accounts, workload identities, tokens, and permission boundaries.
Definitions vary across vendors on whether reconnaissance begins only after authenticated access or also includes unauthenticated probing of public cloud surfaces. NHI Management Group treats it as any systematic mapping activity that improves an attacker’s ability to select targets, escalate privileges, or hide laterally. That includes calls to control-plane APIs, enumeration of metadata services, and testing of identity permissions across regions or subscriptions. The concept aligns closely with discovery and exposure management in the NIST Cybersecurity Framework 2.0, but cloud reconnaissance is more specific because it is driven by cloud-native identity and control-plane telemetry.
The most common misapplication is treating all discovery traffic as routine administration, which occurs when security teams do not separate operator automation from unusual enumeration patterns tied to unfamiliar identities.
Examples and Use Cases
Implementing cloud reconnaissance detection rigorously often introduces telemetry and correlation overhead, requiring organisations to weigh broader visibility against higher ingestion and tuning costs.
- A newly observed workload identity repeatedly lists storage buckets, IAM policies, and secret references across several accounts, indicating possible pre-exploitation mapping rather than normal application behavior.
- Attackers query cloud metadata endpoints and then pivot to control-plane APIs to identify attached roles, instance profiles, and reachable services, a pattern discussed in NHI breach analysis such as the 230M AWS environment compromise.
- A compromised CI/CD service account enumerates repositories, container registries, and key vault references before any payload execution, which can precede secret theft and privilege escalation like the Azure Key Vault privilege escalation exposure.
- Security teams correlate unusual list-and-describe API bursts with geo-anomalous identity activity and blocked authentications, using guidance from NIST Cybersecurity Framework 2.0 to anchor detection and response logic.
- Public exposure checks against cloud storage, identity endpoints, and orchestration services are used in threat hunting to distinguish benign inventory tooling from adversarial discovery.
Cloud reconnaissance is often first visible in the event stream after a service account suddenly touches assets it has never needed before, which is why identity context matters as much as network indicators.
Why It Matters in NHI Security
Cloud reconnaissance matters because it exposes how much an attacker already understands about an environment before privilege escalation or data access begins. Once discovery is underway, exposed identities, permissive roles, stale tokens, and overbroad service accounts become the path of least resistance. That is especially relevant in NHI-heavy environments where workload identities can outnumber humans and where ephemeral trust paths change faster than manual reviews can keep up.
NHIMG research shows that 35.6% of organisations cite consistent access management across hybrid and multi-cloud environments as their top NHI security challenge, which helps explain why reconnaissance often succeeds first in fragmented estates. The 2024 Non-Human Identity Security Report also found that 88.5% of organisations say their NHI IAM practices lag behind or merely match their human IAM efforts, leaving cloud control planes easier to map than defenders expect. Discovery patterns are easier to miss in incidents like the Snowflake breach and the DeepSeek breach, where identity and access boundaries were central to impact.
Organisations typically encounter the operational cost of cloud reconnaissance only after a suspicious identity has already mapped enough of the environment to make containment slower and remediation far more disruptive.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Cloud discovery often begins with enumeration of NHI assets and exposed trust paths. |
| NIST CSF 2.0 | DE.CM-1 | Cloud reconnaissance is detectable as suspicious events that require continuous monitoring. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust assumes discovery attempts may occur and limits what can be learned. |
| NIST AI RMF | Reconnaissance risk depends on how AI systems expose or infer cloud state. | |
| CSA MAESTRO | MAESTRO addresses agentic cloud access paths that adversaries may enumerate. |
Watch for abnormal listing and discovery activity across NHI assets, then block or alert on reconnaissance patterns.
