Notifications
Clear all
Topic starter
14/08/2026 6:33 pm
TL;DR: Repeated AWS pentesting at a major U.S. transportation and logistics company found IAM weaknesses that chained into privilege escalation, full account compromise paths, and sensitive data exposure, according to Horizons.ai. The lesson is that cloud security posture is measured by exploitable identity paths, not by misconfiguration counts alone.
NHIMG editorial — based on content published by Horizons.ai: From Patch Tuesday to Pentest Wednesday®: How a Major Transportation Company Turned AWS Attack Paths Into Action
By the numbers:
- Four AWS weaknesses connected to 25 potential impacts, including 22 paths to AWS full account compromise and three involving sensitive data exposure.
- In just over 42 minutes, NodeZero safely mapped how an attacker could progress through AWS STS, connected roles, discovered users, and IAM policies to an exploitable weakness.
Questions worth separating out
Q: What breaks when AWS IAM findings are treated as isolated misconfigurations?
A: You miss the way permissions combine into a usable attack path.
Q: Why do AWS permissions create account compromise risk even without malware?
A: Because attackers can abuse legitimate identity mechanics.
Q: How do security teams know whether AWS remediation actually worked?
A: They retest the same attack path after the change.
Practitioner guidance
- Map AWS identity attack paths before remediating findings Group IAM permissions, role trust policies, and STS assumptions into end-to-end attack paths so you can see which identities enable escalation and which only create noise.
- Prioritise permissions that enable credential creation or role takeover Review actions such as credential creation, login profile changes, and role trust updates as high-risk because they can convert ordinary access into privileged access.
- Retest after every cloud change Re-run validation after policy, role, or workload changes to confirm that the exploitable path is actually closed and has not reappeared through a new permission combination.
What's in the full article
Horizons.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The specific AWS IAM permission combinations that created the tested escalation paths.
- The before-and-after remediation sequence showing how 102 weaknesses were reduced to one open item in one view.
- The broader validation workflow across cloud, internal, external, and web application environments.
- The threat-actor mapping that linked findings to known adversary techniques.
👉 Read Horizons.ai's blog on AWS attack paths and account compromise risk →
AWS IAM weaknesses and attack paths: are your controls keeping up?
Explore further
14/08/2026 6:41 pm
Attack-path visibility is now the real control plane for AWS identity risk. The article shows that isolated IAM findings only became meaningful when they were chained into actions that could lead to account compromise. That is the right frame for NHI governance in cloud estates: a permission matters only when it can be operationalised by an attacker. Practitioners should treat attack-path evidence as the governing unit of risk, not the raw misconfiguration count.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations reduce AWS identity blast radius?
A: By limiting which identities can create credentials, alter trust, or assume privilege, and by validating those relationships continuously as the environment changes. The objective is not perfect configuration hygiene. It is shrinking the number of reachable paths that can lead from a low-value identity to account control.
👉 Read our full editorial: AWS attack paths expose how identity weaknesses become account compromise
