Poor cloud security leaves secrets & data at risk, report finds
A new report from Tenable Research has detailed the ongoing risks facing organisations due to poor cloud security practices and widespread misconfigurations.
The 2025 Cloud Security Risk Report analyses data from global cloud systems spanning October 2024 to March 2025. It highlights significant vulnerabilities related to data exposure, identity management, cloud workloads, and the use of artificial intelligence resources. The findings indicate that sensitive information and credentials remain at risk due to inconsistent security implementations across major public cloud providers.
Exposure of sensitive data
According to Tenable Research, 9% of publicly accessible cloud storage contains sensitive data, and 97% of this content is classified as restricted or confidential. These circumstances increase the risk of exploitation, particularly when misconfigurations or embedded secrets are also present.
The report notes that cloud environments are subject to significantly heightened risk from exposed data, misconfigured access, and the insecure storage of secrets such as passwords, API keys, and other credentials. These issues are compounded by underlying vulnerabilities and inconsistent security practices across organisations using public cloud providers like Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
Secrets and workload security
The assessment documented that over half of organisations (54%) store at least one secret directly within AWS Elastic Container Service (ECS) task definitions, creating a direct attack path for threat actors. On GCP Cloud Run, similar patterns were observed, with 52% of organisations found to be storing secrets within resources, and 31% on Microsoft Azure Logic Apps workflows.
Furthermore, 3.5% of all AWS Elastic Compute Cloud (EC2) instances were identified as containing secrets within user data. AWS EC2's broad adoption means this level of exposure represents a substantial risk across the industry.
The report points to some improvement in cloud workload security: the prevalence of the so-called "toxic cloud trilogy"-a situation in which a workload is publicly exposed, critically vulnerable, and endowed with high privilege-has decreased from 38% to 29%. However, Tenable researchers note that this combination continues to represent a significant risk for businesses.
Issues in identity and access management
One significant finding relates to the use of Identity Providers (IdPs). The research indicates that 83% of AWS organisations employ IdP services to manage cloud identities, which is regarded as best practice. Despite this, risks persist due to permissive default settings, excessive entitlements, and lingering standing permissions that give rise to identity-based threats. "Despite the security incidents we have witnessed over the past few years, organizations continue to leave critical cloud assets, from sensitive data to secrets, exposed through avoidable misconfigurations," said Ari Eitan, Director of Cloud Security Research, Tenable.
The report suggests that attackers are often able to find entry points with relative ease, exploiting public access, extracting embedded secrets, or misusing over-privileged identities.
Recommendations and risk management "The path for attackers is often simple: exploit public access, steal embedded secrets or abuse overprivileged identities. To close these gaps, security teams need full visibility across their environments and the ability to prioritize and automate remediation before threats escalate. The cloud demands continuous, proactive risk management, and not reactive patchwork," added Eitan.
Tenable's analysis is based on telemetry collected from a diverse array of public cloud and enterprise environments and provides detailed insight into the cloud security challenges currently faced by businesses. The report offers practical recommendations to help security professionals reduce risks, mitigate vulnerabilities, and address gaps before they can be exploited.
The findings underline the necessity for organisations to adopt unified cloud exposure management, increase visibility across their cloud assets, and take a systematic approach to automation and remediation of security risks, particularly as cloud adoption and reliance on AI-driven resources continue to rise.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
9 hours ago
- Techday NZ
Wild Tech hires Andrew Kirk to lead enterprise cloud growth
Wild Tech has appointed Andrew Kirk as Senior Business Development Manager to drive the company's expansion in enterprise-grade managed services and digital transformation partnerships. Kirk brings extensive experience from previous senior roles at Telstra and IBM, and comprehensive familiarity with Amazon, Microsoft and Google Cloud platforms. Wild Tech aims to leverage Kirk's expertise to assist organisations seeking to modernise operations and build robust, cloud-first environments. Dan Whittle, General Manager – Managed Services at Wild Tech, stated, "Andrew's background working with Tier 1 enterprises makes him an exceptional fit for our next phase of growth. He has walked in the shoes of large, complex organisations and knows what it takes to implement scalable, compliant solutions that deliver real outcomes. His insight will be pivotal as we help clients transition from project-based deployments to ongoing service-led transformation." During his tenure at Telstra, Kirk held responsibility for the profit and loss in Cloud Services and led the introduction of Microsoft, Amazon, and Cisco cloud offerings across Australia and the broader APAC region. Early in his career, he was involved in the development of managed desktop services at Advantra, a joint venture between IBM, Lend Lease, and Telstra. More recently, Kirk played a role in establishing Searce's Australian operations, with a focus on Google Cloud and AWS solutions for the retail and mining sectors. In joining Wild Tech, Kirk steps into a role centred on expanding the company's influence across the enterprise and upper mid-market sector, concentrating on government, financial services, and retail. He will facilitate the alignment of long-term managed services with cloud, AI, and data solutions. "The appetite for transformation is strong—but the real challenge is productivity," Kirk said. "Wild Tech gets this. They're not just delivering tech projects, they're embedding long-term capability and service models that evolve with the client and drive the bottom line. That's exactly where I want to be." Kirk's recruitment supports Wild Tech's approach of linking technology delivery with operational excellence through a managed services approach tailored to enterprise requirements. Wild Tech states that its strategy for transformation is rooted in a comprehensive understanding of specific industry demands. The company asserts the importance of listening to clients to remain ahead of evolving requirements, and of taking into account how end-to-end business processes and organisational maturity interact with each technology platform's capability. The company continues to position itself as an Australian-owned and operated entity serving clients across APAC, with a focus on building the next generation of digital operating models through partnerships and established market platforms. Follow us on: Share on:
Techday NZ
5 days ago
- Techday NZ
Poor cloud security leaves secrets & data at risk, report finds
A new report from Tenable Research has detailed the ongoing risks facing organisations due to poor cloud security practices and widespread misconfigurations. The 2025 Cloud Security Risk Report analyses data from global cloud systems spanning October 2024 to March 2025. It highlights significant vulnerabilities related to data exposure, identity management, cloud workloads, and the use of artificial intelligence resources. The findings indicate that sensitive information and credentials remain at risk due to inconsistent security implementations across major public cloud providers. Exposure of sensitive data According to Tenable Research, 9% of publicly accessible cloud storage contains sensitive data, and 97% of this content is classified as restricted or confidential. These circumstances increase the risk of exploitation, particularly when misconfigurations or embedded secrets are also present. The report notes that cloud environments are subject to significantly heightened risk from exposed data, misconfigured access, and the insecure storage of secrets such as passwords, API keys, and other credentials. These issues are compounded by underlying vulnerabilities and inconsistent security practices across organisations using public cloud providers like Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. Secrets and workload security The assessment documented that over half of organisations (54%) store at least one secret directly within AWS Elastic Container Service (ECS) task definitions, creating a direct attack path for threat actors. On GCP Cloud Run, similar patterns were observed, with 52% of organisations found to be storing secrets within resources, and 31% on Microsoft Azure Logic Apps workflows. Furthermore, 3.5% of all AWS Elastic Compute Cloud (EC2) instances were identified as containing secrets within user data. AWS EC2's broad adoption means this level of exposure represents a substantial risk across the industry. The report points to some improvement in cloud workload security: the prevalence of the so-called "toxic cloud trilogy"-a situation in which a workload is publicly exposed, critically vulnerable, and endowed with high privilege-has decreased from 38% to 29%. However, Tenable researchers note that this combination continues to represent a significant risk for businesses. Issues in identity and access management One significant finding relates to the use of Identity Providers (IdPs). The research indicates that 83% of AWS organisations employ IdP services to manage cloud identities, which is regarded as best practice. Despite this, risks persist due to permissive default settings, excessive entitlements, and lingering standing permissions that give rise to identity-based threats. "Despite the security incidents we have witnessed over the past few years, organizations continue to leave critical cloud assets, from sensitive data to secrets, exposed through avoidable misconfigurations," said Ari Eitan, Director of Cloud Security Research, Tenable. The report suggests that attackers are often able to find entry points with relative ease, exploiting public access, extracting embedded secrets, or misusing over-privileged identities. Recommendations and risk management "The path for attackers is often simple: exploit public access, steal embedded secrets or abuse overprivileged identities. To close these gaps, security teams need full visibility across their environments and the ability to prioritize and automate remediation before threats escalate. The cloud demands continuous, proactive risk management, and not reactive patchwork," added Eitan. Tenable's analysis is based on telemetry collected from a diverse array of public cloud and enterprise environments and provides detailed insight into the cloud security challenges currently faced by businesses. The report offers practical recommendations to help security professionals reduce risks, mitigate vulnerabilities, and address gaps before they can be exploited. The findings underline the necessity for organisations to adopt unified cloud exposure management, increase visibility across their cloud assets, and take a systematic approach to automation and remediation of security risks, particularly as cloud adoption and reliance on AI-driven resources continue to rise.
Techday NZ
5 days ago
- Techday NZ
NiCE & AWS deepen AI partnership to power CX automation
NiCE has announced an expansion of its collaboration with Amazon Web Services (AWS) to drive intelligent automation through its CXone Mpower platform, introducing enhanced integration with various AWS artificial intelligence (AI) offerings. The collaboration aims to accelerate the deployment and scaling of AI-powered customer service solutions by combining NiCE's customer service automation expertise and interaction data with AWS's cloud and AI technology. The effort is focused on enabling end-to-end automation across enterprises using NiCE's CXone Mpower solution and AWS services like Amazon Bedrock, Amazon Q, and Amazon SageMaker. Expanded integration NiCE and AWS are integrating generative AI services across the CXone Mpower platform to enable automation throughout enterprise workflows. The initiative covers several use cases, including automated AI agent creation, intelligent workflow orchestration and real-time AI-supported guidance for employees. With the integration, Mpower Agents will allow businesses to deploy AI agents instantly and without coding or prompt engineering, tailored to each organisation's specific needs. Using Amazon Q index, these agents access the latest policy, product and case information for accurate responses. Training on rich customer experience data is enabled through Amazon SageMaker, ensuring continuous learning from best practices and high-performing interactions. The platform also features CXone Mpower Orchestrator, which integrates with Amazon Q Business to connect enterprise systems, applications and data. This functionality enables more personalised, seamless customer journeys by breaking down operational silos, delivering real-time decisions using the AWS Nova family of large language models for various objectives such as speed, accuracy and business impact. The CXone Mpower Copilot tool supports agents, supervisors and leaders with real-time AI-powered assistance, aiming to streamline tasks and support productivity. AWS's global infrastructure underpins this function, allowing deployments with low latency and high availability across different geographies. Leadership comments NiCE brings decades of deep customer service expertise, rich data and a proven AI-based foundation. AWS brings enhanced scale, infrastructure and generative AI innovation. Together, we're delivering enterprise-wide automation, turning vision into action across the front, middle and back office. Mpower Agents are just one example: AI-powered agents that deploy instantly, adapt in real time and operate with precision at scale. According to Barry Cooper, President of the CX Division at NiCE, the collaboration is designed to deliver broad automation and responsive AI agents that adjust and function efficiently at enterprise scale. Mila D'Antonio, Principal Analyst at Omdia, described the collaboration as an example of complementary capabilities, stating: "This collaboration is a textbook case of complementary strengths coming together: NiCE has the domain depth, the data, and the AI maturity in CX; AWS has the tools, infrastructure, and generative AI firepower. The result is innovation like Mpower Agents that are enterprise-ready, context-aware, and built to scale, delivering automation with both intelligence and impact." Customer reaction Taylor Mobley, Chief Revenue Officer at Bamboo Insurance commented on the partnership's impact: "This collaboration between NiCE and AWS is raising the bar for what's possible with AI in the enterprise. By combining deep expertise with powerful technology, it will help us move faster, work smarter, deliver more value across the board, and ultimately provide a better, more personalised experience for our customers." The director of customer experience at Vera Bradley, Susan Campbell, noted the partnership's ongoing evolution: "We're always excited to see the innovative things we can do with CXone Mpower... and we know CXone Mpower will evolve with us, so we can continue to improve the customer experience—even into the future. I feel like NiCE wants to make us a better version of ourselves. And there aren't a lot of other companies that really invest in thought leadership, especially around how AI will forever change the face of the contact center." AWS perspective Rohan Karmarkar, Managing Director, Partner Solution Architecture at AWS, said the partnership broadens the capabilities available to businesses: "At AWS, we're committed to providing the capabilities to help businesses with AI-powered transformations. By combining Amazon Bedrock, Amazon Q, and our Nova family of LLMs with NICE's CXone Mpower, we're enabling enterprises to deploy intelligent automation that's both powerful and purpose-built for real customer challenges. This collaboration with NICE demonstrates how AWS's generative AI capabilities can help accelerate innovation at scale across customer experience workflows." The announcement follows a trend among enterprise technology providers to incorporate generative AI features in customer experience platforms, seeking to streamline operations, improve accuracy, and personalise customer engagement through scalable technologies.
