Cloud complexity and misconfiguration epidemic¶

Anyone who has stood in the middle of Ankh-Morpork and wondered how a city can be both thriving and permanently on fire already understands modern cloud architecture. It is a place of great promise and greater confusion, where good intentions go to retire and temporary solutions set down roots, apply for citizenship, and start families.

Many organisations now operate multi-cloud and hybrid environments that resemble a badly organised thieves’ guild: overlapping IAM policies contradicting one another like rival street gangs, storage buckets lingering like stains nobody remembers creating, service accounts that refuse to die, and VPNs meant to last two weeks that are now part of the cultural heritage. Misconfiguration has become the new malware because it is cheap, quiet, and grows like weeds between the cobbles. Malware requires skill. Misconfiguration requires only enthusiasm and a console login.

The clerk’s brief¶

September 2026: One door in five¶

The ENISA Threat Landscape 2026, published 22 September 2026, could name an intrusion vector for only 5.2 per cent of the unauthorised-access incidents it recorded; of those, 60.4 per cent used a vulnerability and 20.7 per cent a misconfiguration or accidental exposure. The clerks note that the door left open was one in five of the doors anyone could find.

June 2025: Three strikes¶

Tenable’s cloud security risk report, published June 2025, finds workloads that are simultaneously publicly exposed, critically vulnerable and highly privileged in 29 per cent of the organisations analysed, down from 38 per cent. 54 per cent of organisations using AWS ECS had at least one task definition with an embedded secret, and 9 per cent of publicly accessible cloud storage contained sensitive data. The clerks note that a workload combining exposure, vulnerability and privilege is not so much a risk as an appointment.

June 2025: Open to the public¶

The Cloud Security Alliance published a case study of the 2024 Football Australia breach in June 2025: developers misconfigured storage buckets. The question with an unprotected repository is rarely whether someone will look, only when. The clerks file this one under precedents that will be cited again.

May 2025: In the shop window¶

Wiz’s analysis of real-world cloud accounts, published May 2025, found 54 per cent of environments with exposed virtual machines or serverless instances containing sensitive information, and 72 per cent with publicly exposed PaaS databases lacking access controls, though Wiz notes that public does not always mean dangerous. These are not edge cases.

Outlook cloudy¶

The stratum underneath is the remote-work scramble of March 2020, when security was neglected for a home office that worked ad hoc.

The clerks’ standing assessment is that the cloud did not weaken anyone’s security so much as it made everyone’s shortcuts publicly routable, and that the next incident is more likely to arrive through a forgotten bucket than a brilliant adversary.