Cloud misconfigurations and credential theft still drive cloud breaches

At a glance

What this is: SentinelOne argues that cloud breaches still begin with two familiar failures: misconfigurations and compromised credentials, then worsen when attackers chain small weaknesses into deeper access.

Why it matters: For IAM, NHI and cloud security teams, the article shows that access governance, secret handling and configuration review must be treated as linked controls rather than separate hygiene tasks.

Context

Cloud security failures often start before any malware or exploit is involved. A public storage bucket, an overly permissive role, or a leaked API key can each create an entry point, and the risk rises sharply when teams treat those issues as isolated findings instead of parts of one access path.

For IAM and NHI practitioners, the article sits at the intersection of configuration governance, secret management and privilege scope. It shows that cloud access risk is not only about authentication, but also about how misconfigured services, delegated roles and exposed credentials combine into a usable attacker path.

Key questions

Q: What breaks when cloud misconfigurations are assessed one alert at a time?

A: Teams miss the path that attackers actually use. A low-severity public bucket, a permissive role and a weak logging posture can become a high-impact chain when they are combined. The practical failure is treating each issue as a separate ticket instead of asking whether it completes entry, escalation or exfiltration for the attacker.

Q: Why do leaked cloud credentials create such a large blast radius?

A: Cloud credentials often inherit broad trust across multiple services, pipelines and data stores. Once stolen, they can bypass perimeter controls and enable lateral movement without exploitation noise. The risk is not only that a secret is exposed, but that its scope and lifetime let the attacker reuse it across connected systems.

Q: What are the signs that cloud misconfiguration monitoring is failing?

A: The clearest signs are long-lived exposure, repeated findings without remediation, and blind spots across distributed cloud assets. If public storage, open ports, or weak IAM settings remain undetected for weeks or months, monitoring is not operationally effective. Teams should also watch for alert overload, because excessive unprioritized findings often hide the issues that matter most.

Q: How should teams respond when an attacker may have created the misconfiguration?

A: Treat the cloud state as potentially contaminated. Review recent role changes, service disablement, automation activity and policy edits for attacker-created access expansion, then validate whether the change was part of normal operations or used to widen control. That approach shifts response from static remediation to drift investigation.

Technical breakdown

How cloud misconfigurations become an access path

A cloud misconfiguration becomes an attack path when an exposed service, public storage setting or permissive role creates a reachable control plane surface. In practice, attackers do not need a single catastrophic flaw. They often need several modest failures that line up, such as weak storage exposure, over-broad permissions and insufficient logging. CSPM tools can surface these issues, but they do not automatically tell teams which combination matters most. That is why contextual prioritisation is critical. A low-severity issue can become high risk when it sits next to another weakness that expands reach or enables discovery.

Practical implication: rank cloud findings by exploitability in combination, not by severity in isolation.

Why leaked credentials remain the fastest route to lateral movement

Compromised credentials are valuable because cloud platforms connect many services behind a single trust boundary. Once an attacker has a valid key, token or secret, they can often access multiple systems without triggering obvious perimeter alerts. That is why secret scanning, revocation and rotation are governance controls, not optional hygiene. The article’s examples show that a single leak can unlock data stores, build systems and downstream services, including supply chain dependencies. In cloud environments, the problem is not just exposure. It is the blast radius that follows from a credential with too much reach or too long a lifetime.

Practical implication: treat every exposed secret as a potential multi-system access event and revoke it immediately.

How attacker-driven misconfigurations change the defender’s model

The article highlights a less intuitive pattern: adversaries do not only exploit existing misconfigurations, they can create or deepen them during an attack. That means defenders cannot rely on a static inventory of what was misconfigured at scan time. They need to distinguish between baseline misconfiguration and attacker-induced privilege changes, service disablement or newly created cloud identities. This is especially relevant to NHI governance, where service roles, temporary functions and automation can be abused to create persistence or lateral movement opportunities. Static posture tools alone will miss that shift in state.

Practical implication: monitor cloud identity and configuration drift as an active attack signal, not just a compliance issue.

Threat narrative

Attacker objective: The attacker aims to turn a small cloud access mistake into broader access, data theft, and downstream compromise across connected systems.

1. Entry occurs through a public cloud storage misconfiguration, a leaked secret, or an overly permissive role that gives the attacker a valid foothold.
2. Credential access or privilege abuse follows when the attacker uses the exposed key, token or role to expand reach across connected cloud services.
3. Lateral movement and collection occur as the attacker chains misconfigurations or creates new permissive identities to reach additional systems and data.
4. Impact is data exfiltration, supply chain exposure, or wider cloud compromise across workloads and services.

NHI Mgmt Group analysis

Cloud access governance now lives at the boundary between configuration and identity. The article shows that the old split between CSPM and secret management is increasingly artificial. A public bucket, an over-permissive role, and a leaked key all become the same problem once an attacker can chain them. Practitioners should treat cloud access as one governance surface, not two disconnected tool categories.

Credential exposure is a blast-radius problem, not a hygiene problem. When a single secret can unlock multiple services, the control question is how far the credential can travel before it is revoked. That makes lifecycle discipline, scoping and revocation speed more important than simple detection alone. For identity programmes, this is where NHI governance becomes operational cloud security rather than a niche concern.

Attacker-driven misconfiguration is the concept teams need to name. The article points to a class of cloud incidents where the adversary does not just find weak settings, but creates new ones to widen access or suppress defence. That changes the defender’s model from finding bad configuration to detecting configuration drift as a malicious act. Teams should assume the cloud state itself can become an attacker output.

Misconfiguration chains are the next maturity gap in cloud defence. Many teams still score and triage findings one by one, but attackers increasingly succeed by combining low-visibility issues into a higher-risk path. That means the real governance test is whether security teams can reconstruct the path, not simply close the loudest alert. The practitioner conclusion is to move from issue management to path management.

Service roles and ephemeral automation are now part of the same risk story. The article’s examples show how automation can create or amplify misconfigurations that look operational on the surface but function as access expansion under attack. For IAM and cloud teams, this makes workload identity inventory and role review central to cloud resilience, not just to access administration.

What this signals

Misconfiguration chains are becoming the real cloud governance problem. Security teams should stop assuming that a single critical finding explains most breaches. The more useful question is whether several ordinary weaknesses together create a path from public exposure to privileged access and then to data movement.

Credential governance now has to sit alongside posture management. When exposed secrets and permissive roles can be chained into the same attack path, the division between cloud security teams and identity teams becomes a liability. The reader’s programme should be built around access scope, revocation speed and drift detection as one control story.

Attackers can turn your cloud control plane into their configuration engine. That is the practical lesson from attacker-driven misconfiguration. It means defenders need to watch for changes that look administrative on the surface but function as access expansion, persistence or defence suppression under attack.

For practitioners

• Prioritise misconfigurations by attack chain Review CSPM output for combinations of storage exposure, permissive roles and missing logging that form a realistic entry-to-exfiltration path.
• Scan and revoke exposed credentials faster Deploy secret scanning across code, CI and cloud assets, then automate immediate revocation and replacement of any discovered key or token.
• Model cloud identity drift as hostile until proven otherwise Track unexpected role creation, policy expansion, service disablement and automation changes as potential attacker-driven misconfiguration rather than routine drift.
• Consolidate cloud access governance Bring configuration review, NHI inventory and privilege scope under one operating model so teams can see how a single weakness expands blast radius.

Key takeaways

• Cloud breaches still begin with familiar cloud failures, but attackers now win by chaining them into a usable path rather than relying on a single major flaw.
• Leaked credentials matter because cloud trust is broad enough for one secret to unlock multiple systems, data stores and downstream services.
• The control gap is no longer only detection. Teams need path-based prioritisation, faster revocation and monitoring for attacker-driven configuration drift.

Key terms

• Cloud misconfiguration: A security failure caused by incorrect permissions, exposure settings, or integration design in cloud services. It is often less about the cloud platform itself and more about access paths that were created quickly, left broad, and never fully revalidated against actual business need.
• Credential Theft: Credential theft is the unauthorized capture of secrets used to authenticate a user or workload, such as passwords, MFA codes, or security questions. In SaaS environments, it usually produces login events that defenders can inspect, but it still becomes dangerous when attackers combine it with token abuse or integration misuse.
• Attack Chain: An attack chain is a sequence of prompts, observations, and tool calls that moves an AI agent from a benign starting point to a harmful result. In agent security, the chain matters more than any single prompt because real risk often emerges only when actions accumulate across steps.
• Attacker-Driven Misconfiguration: Attacker-driven misconfiguration is when an adversary creates or changes cloud settings during an intrusion to widen access, hide activity or enable persistence. It shifts the problem from finding bad configuration at rest to detecting malicious state change while the attack is underway.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management for practitioners who need to connect identity controls to cloud risk. It helps security teams translate access lifecycle discipline into day-to-day governance decisions across modern environments.