Cloud Security Statistics Guide: Misconfigurations, Identity Abuse and Cloud Incidents

Cloud security statistics are repeated so often that most quoted figures no longer say which report, which year or which sample they came from. This page collects the cloud figures that matter to defenders directly from the publishers' own reports: the Google Cloud Threat Horizons Report, the Verizon Data Breach Investigations Report (DBIR), the Microsoft Digital Defense Report, CrowdStrike's threat reports, Datadog's State of Cloud Security and IBM's annual studies. Every figure carries the report name, publisher and edition year in the same sentence or table row, and figures we could not trace to a primary source are left out. It is written for cloud security engineers, security architects and leaders who need numbers they can defend in a risk register or business case. Last reviewed: October 2026.

Key takeaways

• Identity is the cloud attack surface. The Google Cloud Threat Horizons Report H1 2026 finds that threat actors exploited identity issues for initial access in 83% of Mandiant incidents involving major cloud and SaaS environments in the second half of 2025.
• Software flaws overtook weak credentials, for now. In the same Google report, third-party software entry rose to 44.5% of Google Cloud initial access in H2 2025, while weak or absent credentials fell from 47.1% to 27.2%. Credentials remain the second largest vector.
• Exposure is punished in hours. The Microsoft Digital Defense Report 2026 puts the average time before an exposed cloud workload is attacked at 5.3 hours.
• Long-lived keys are still everywhere. Datadog's State of Cloud Security 2025 finds that 59% of AWS IAM users with an active access key have one older than a year, and 55% of Google Cloud service accounts with active keys are in the same position.
• Cloud adversaries keep growing. The CrowdStrike 2026 Global Threat Report records a 266% increase in cloud-conscious intrusions by state-nexus actors in 2025, and the CrowdStrike 2026 Threat Hunting Report a 171% surge in cloud-conscious eCrime activity.

Headline statistics

The table gives the cloud figures most often requested, each from the latest edition we could read on the publisher's own site in October 2026. Where a report gives the period of its data, the period is shown.

Statistics by theme

How attackers get into cloud environments

The Google Cloud Threat Horizons Report H1 2026 gives two separate views of initial access, and they should not be merged. The first is Google Cloud's own incident data, which the report says reflects a subset of observed activity. The second is Mandiant incident response and managed defence casework, which is platform-agnostic.

• Mandiant view (H2 2025): the Threat Horizons Report H1 2026 attributes 21% of Mandiant cases to stolen human and non-human identities, 21% to compromised trusted third-party relationships, 17% to voice phishing, 12% to email phishing, 7% to misconfiguration, 7% to insiders including DPRK IT workers, 3% to software supply chain compromise and 2% to vulnerability exploitation.
• Exploitation everywhere: outside cloud specifically, the IBM X-Force Threat Intelligence Index 2026 names vulnerability exploitation as the leading cause of attacks in 2025 at 40% of incidents, with a 44% increase in attacks that began by exploiting public-facing applications. Cloud-hosted web front ends are part of that population.
• Breach view: the Verizon 2026 DBIR finds the Basic Web Application Attacks pattern, which covers attacks on internet-facing web applications, in 10% of breaches, down from 18% in the previous edition.

See the Cloud Misconfiguration Guide and the Top 10 Cloud Security Risks.

Identity and credential abuse in cloud

• Identity as the entry point: 83% of Mandiant incidents in major cloud and SaaS environments in H2 2025 began with an identity issue, according to the Google Cloud Threat Horizons Report H1 2026.
• Cloud identity in critical infrastructure: the Microsoft Digital Defense Report 2026 states that 78% of observed attack techniques against critical infrastructure used cloud identity abuse.
• Credential theft after entry: the same Microsoft 2026 report finds follow-on credential theft in 52.2% of intrusions that started with a valid account, so one stolen identity is usually used to collect more.
• Third-party cloud MFA gaps: the Verizon 2026 DBIR reports that only 23% of third-party organisations fully remediated missing or improperly secured MFA on their cloud accounts, across 7,513 findings, and that weak passwords and permission misconfigurations took almost eight months to reach 50% remediation.
• Device code phishing: the CrowdStrike 2026 Threat Hunting Report (July 2025 to June 2026) records a 15x spike in monthly device code phishing attempts, a technique aimed squarely at cloud identity providers. See the Device Code Phishing Guide.

The Snowflake breach is the clearest recent illustration: about 165 customer accounts were accessed in 2024 with infostealer credentials on accounts without MFA, some stolen years earlier and never rotated. See the Cloud Credential Compromise Playbook.

Long-lived credentials and workload posture

Datadog's State of Cloud Security 2025, published 8 October 2025 and based on posture data from thousands of organisations collected in September 2025, is one of the few recurring sources that measures configuration directly rather than through incidents.

Datadog also reports that over half of the year-old AWS access keys had been unused for more than 90 days, which means they could be deleted with little operational risk. IMDSv2 matters because the instance metadata service is how cloud workloads obtain role credentials (MITRE ATT&CK T1552.005, Cloud Instance Metadata API); the Capital One breach is widely attributed to SSRF against that service, and an over-privileged firewall role turned it into exposure of about 106 million people. See the Cloud Workload Identity Guide.

Storage exposure, Kubernetes and third-party access

• Public storage: Datadog's State of Cloud Security 2025 finds 1% of S3 buckets effectively public (1.5% in 2024) and 83% covered by a public access block; 1.3% of Azure Blob Storage containers are effectively public, down from 2.6%.
• Managed Kubernetes: the same 2025 report finds clusters exposed to the internet at 39% for EKS, 34% for AKS and 54% for GKE, and 13% of EKS clusters with a risky node role.
• Third-party integration roles: Datadog 2025 counts an average of 13 third-party integration roles per organisation (10.2 the year before), with 12.2% overprivileged.
• Third parties in breaches: the Verizon 2026 DBIR records third-party involvement in 48% of breaches, a 60% increase on the previous dataset.

Cloud threat actors and speed

• State-nexus cloud activity: the CrowdStrike 2026 Global Threat Report (activity in 2025) records a 266% increase in cloud-conscious intrusions by state-nexus actors.
• eCrime in cloud: the CrowdStrike 2026 Threat Hunting Report (1 July 2025 to 30 June 2026) records a 171% surge in cloud-conscious eCrime activity and an LLMjacking campaign that sent 200,000 API requests in two minutes.
• Breakout: the CrowdStrike 2026 Global Threat Report gives 27 seconds as the fastest eCrime breakout time on record.
• Cloud AI workloads: the IBM Cost of a Data Breach Report 2026 finds that among organisations reporting a breach of AI models or applications, cloud misconfigurations affecting AI workloads were a cause in 27% of cases.

What the numbers mean for defenders

Read together, the reports describe the same mechanism: cloud breaches are mostly identity events, and the identities that fail are often long-lived machine credentials or third-party accounts that nobody reviews. The decline in weak-credential entry in the Google data in H2 2025 coincides with a spike in software exploitation, which argues for doing both jobs, not switching from one to the other.

In NIST CSF 2.0 terms these sit mainly in PR.AA (Identity Management, Authentication, and Access Control) and DE.CM (Continuous Monitoring). See the Cloud PAM and CIEM Guide and the ITDR Guide.

Turning the statistics into a programme

1. Baseline your own numbers first: measure key age, IMDSv2 enforcement, public storage and MFA coverage in your accounts with your posture tool, so you can compare against the Datadog and Verizon figures rather than quoting them.
2. Fix human cloud access: federate console access, require phishing-resistant MFA for administrators and break-glass accounts, and pilot conditional access in report-only mode before enforcing.
3. Retire long-lived keys: delete keys unused for 90 days, then move workloads to roles and workload identity federation. Disable rather than delete first, so a key can be re-enabled if something breaks.
4. Close metadata and exposure gaps: enable IMDSv2 by default, apply public access blocks at account level and restrict Kubernetes API endpoints, testing in a non-production account first.
5. Review third-party roles: require external IDs, scope permissions and set an owner and review date for each integration.
6. Detect identity abuse: alert on sign-ins from anonymising infrastructure, new access keys, role chaining and unusual data export, and rehearse the response.

Small and large organisations

A small team on one cloud gets most value from the provider's native posture service, federation and a key age report. A large multi-cloud estate needs the same controls enforced as guardrails (service control policies, organisation policies, Azure Policy) and a CIEM or ISPM capability to keep permissions measurable across accounts. Choose native tooling where one provider dominates and a cross-cloud platform when more than one provider holds production data. See the Multi-Cloud Identity Guide.

Metrics worth tracking

• Key age: percentage of active access keys and service account keys older than 90 days and 365 days.
• MFA coverage: percentage of human cloud identities, including third-party users, covered by phishing-resistant MFA.
• IMDSv2 enforcement: percentage of instances and launch templates requiring IMDSv2.
• Exposure: count of public storage resources and internet-exposed cluster endpoints, with time to fix.
• Privilege: percentage of roles with unused permissions over 90 days.
• Detection: median time from a risky cloud sign-in to containment.

Common failure patterns when using cloud statistics

• Merging different samples: the Threat Horizons Report H1 2026 gives misconfiguration as 21% in Google Cloud data and 7% in Mandiant casework for the same half-year. Both are correct for their sample; quoting one as "the" figure misleads.
• Reading a fall as a fix: weak-credential entry fell to 27.2% in H2 2025 because software exploitation rose, not because credentials stopped working. The Snowflake breach shows how old, unrotated credentials still open doors.
• Quoting growth rates without a base: a 266% or 171% increase from CrowdStrike says the trend is steep, not how many organisations are affected. Pair growth figures with a prevalence figure.
• Treating vendor telemetry as a census: Datadog, Microsoft, Google and CrowdStrike figures describe their customers and investigations, not every cloud user.
• Dropping the edition year: cloud posture changes quickly (IMDSv2 enforcement went from 32% to 49% in one Datadog edition), so a figure without its year is soon wrong.

Methodology notes and caveats

The Cloud Security Alliance's Top Threats to Cloud Computing Deep Dive 2025 (published 29 April 2025) analyses eight case studies and stresses identity and access controls; it is qualitative and gives no percentages, so it is listed as a reference rather than a statistic. When these reports publish new editions, replace whole rows rather than mixing years in one comparison. See the Cloud Security Guide for the controls behind each number.

Practitioner checklist

• Quote each figure with its report, publisher and edition year, and say whose customers or cases it describes.
• Measure your own key age, MFA coverage, IMDSv2 enforcement and public exposure before citing industry figures.
• Require phishing-resistant MFA for every human cloud identity, including contractors and third-party users.
• Delete access keys unused for 90 days and set a maximum key age for the rest.
• Enforce IMDSv2 by default and fix launch templates, not just running instances.
• Give every third-party integration role an owner, an external ID and a review date.
• Alert on new keys, role chaining, sign-ins from anonymising networks and bulk data export.
• Recheck this page's figures after each annual or half-yearly release before reusing them.

Standards and references

• Google Cloud: Cloud Threat Horizons Report H1 2026
• Verizon: 2026 Data Breach Investigations Report Executive Summary
• Microsoft: Digital Defense Report 2026
• CrowdStrike: 2026 Global Threat Report Executive Summary
• CrowdStrike: 2026 Threat Hunting Report
• Datadog: State of Cloud Security 2025
• IBM Newsroom: Cost of a Data Breach Report 2026 findings
• Cloud Security Alliance: Top Threats to Cloud Computing Deep Dive 2025

Related NHI Mgmt Group resources: Identity Attack Statistics Guide · Non-Human Identity and Secrets Statistics Guide · Cybersecurity Statistics Guide · Cloud Security Guide · CNAPP Guide