Help Net Security reported on August 14, 2026 that weak IAM controls and missing logging or alerting are among the most widespread cloud security issues across AWS, Azure, and Google Cloud environments. The report, based on Intruder's 2026 Cloud Security Index, says common findings include exposed services, permissive firewall rules, unrotated keys, missing MFA, public storage, weak encryption, unused service accounts, and overly broad service account permissions.
That is not just a cloud engineer problem. For a New Jersey business owner, cloud IAM misconfiguration can decide who can reach company data, which vendors can change systems, whether suspicious activity is logged, and how quickly a mistake can be found. The risk often hides in normal administration screens rather than a dramatic breach notice.
The cloud is not secure by default
Cloud platforms provide strong security tools, but those tools still need ownership. A company can use Microsoft 365, AWS, Azure, Google Cloud, website hosting, backups, accounting software, CRM systems, and line-of-business SaaS without one clear inventory of who manages each tenant and what settings are actually enforced.
The Help Net Security report says weak identity controls, excessive permissions, and incomplete configurations remain common across major cloud providers. It also points to platform-specific patterns: storage and network exposure in AWS, storage security and identity protection issues in Azure, and IAM weaknesses such as missing MFA, unused service accounts, and overly permissive service accounts in Google Cloud.
CISA's cloud configuration work for federal agencies is useful background for private businesses because it treats cloud security as a baseline-setting and evidence problem. The practical lesson is simple: do not accept a general statement that the cloud is handled. Ask which settings were checked, what failed, what changed, and when it will be reviewed again.
The owner decision is about evidence
Most owners do not need to review every permission policy line by line. They do need enough evidence to know whether the MSP, internal IT lead, software vendor, or cloud consultant has a real cloud access review process.
That review should cover the boring settings that create expensive outcomes. Are all administrator accounts protected by MFA? Are old users and contractors removed? Are service accounts named, owned, and limited? Are access keys rotated? Are storage areas private unless there is a documented reason? Are logs turned on where they matter? Are alerts going to someone who is expected to respond?
This is where cloud security becomes a business decision. Approving a new cloud project without those answers can quietly expand risk. Pausing long enough to request the evidence can prevent a small setting from becoming a large incident.
What to ask your IT provider
- Which cloud tenants and services do we have? Ask for a plain inventory that includes Microsoft 365, AWS, Azure, Google Cloud, backups, website hosting, SaaS admin portals, and vendor-managed environments.
- Who owns each administrator and service account? Every privileged account should have a named business or technical owner, not just a shared mailbox or old vendor contact.
- Where is MFA enforced? Confirm MFA for administrators, remote access, cloud consoles, email, finance systems, and any account that can reach sensitive data.
- Which keys and tokens are still active? Ask when cloud keys, API tokens, app secrets, and service-account credentials were last rotated, and whether unused keys were disabled.
- What is publicly reachable? Review storage buckets, databases, management ports, websites, APIs, VPNs, and remote support tools that may be exposed to the internet.
- Is cloud logging and alerting actually working? Logs are useful only if they are retained, monitored, and routed to someone responsible for acting on them.
- What will be fixed first? Request a remediation list with dates, owners, and proof after high-risk changes are completed.
A practical next step
Start with a focused cloud access review instead of a sprawling audit. Pick the systems that matter most: email, file storage, backups, customer records, accounting, line-of-business software, websites, and any cloud console with administrator access.
Ask your provider for a one-page summary of the top findings: inactive users, missing MFA, overprivileged service accounts, public exposure, stale keys, missing logs, and open remediation items. If the answer is only a spreadsheet export with no owner or deadline, the review is not finished.
Cloud growth is useful when someone is keeping track. The settings may be plain, but the business impact is not. A clear inventory, a real cloud access review, and written remediation proof give owners a better way to approve the next cloud project without inheriting yesterday's unchecked permissions.
Sources and further reading
