Topic starter
11/11/2026 6:02 pm
TL;DR: Manual reviews only capture a point in time, so cloud misconfigurations can expand access and expose data for months, according to WatchGuard. Cloud permissions and settings need continuous evaluation if organisations want to shorten exposure windows.
Editorial analysis by NHI Mgmt Group, based on content published by WatchGuard: “How Long Can a Misconfiguration Go Undetected?”.
By the numbers:
- It took around eight months to resolve half of the findings related to weak passwords and misconfigured permissions, according to Verizon's 2026 DBIR cited by WatchGuard.
Key questions
Q: Why do cloud permission misconfigurations linger after they are found?
A: Cloud permission misconfigurations linger when no one owns the fix, approvals are slow, and rollback paths are unclear.
Q: What is the difference between a cloud misconfiguration and a policy exception?
A: A cloud misconfiguration is an unintended insecure setting, such as public storage, overly broad security groups, or disabled logging.
Q: How do I detect cloud misconfigurations before they expose data?
A: Continuous configuration scanning is the most reliable way to spot cloud misconfigurations before they create long-lived exposure.
Practitioner guidance
- Inventory settings that can widen access Catalogue cloud application settings that affect delegation, forwarding, external sharing, and admin consent, then map each to an owner and review cadence.
- Shorten review intervals for identity-linked controls Move from quarterly checks to continuous or daily evaluation for permissions and app integrations that can expose mail, files, or calendars.
- Tie findings to a fix path Require every non-compliant setting to land in a task, owner queue, or approved auto-fix workflow so remediation starts immediately.
Bottom line: Cloud configuration drift is a governance failure because settings can become insecure after provisioning, not only at first setup.
Glossary terms: Cloud misconfiguration, Configuration Drift, Delegated Access, Mail Forwarding Rule
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Cloud misconfiguration is a lifecycle problem, not a one-time setup mistake. The risk emerges when approved settings drift after provisioning, integration, or delegation changes, and that makes fixed-point audits structurally weak. Security teams need to treat the configuration baseline as a live control surface rather than a compliance snapshot. The practitioner implication is to govern change, not just inspect state.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What happens when mail forwarding rules stay open in cloud apps?
A: Open mail forwarding rules can silently copy messages to an external address, bypassing normal visibility and retention controls. In cloud email systems, attackers often use them to persist after account takeover, intercept sensitive data, and hide activity from the mailbox owner. Regular rule review, conditional access, and admin auditing help contain that exposure.
👉 Read our full editorial: Cloud misconfigurations persist until audits catch them