This Year's Cloud Security Index Says AWS Carries the Most Risk. Here's What That Actually Means for You.

A cross-cloud misconfiguration study released this year, drawing on data from roughly 3,000 organizations, found AWS carrying the highest prevalence of misconfigurations in five of the six categories measured: weak identity and access controls, missing logging and alerting, misconfigured services, permissive firewalls, and weak encryption. The headline writes itself: “AWS is the riskiest cloud.” The actual finding is less dramatic and more useful.

Why the biggest provider tops the list

AWS has more services and more configuration surface than any other provider, which mechanically means more places to get a setting wrong. The study's own framing backs this up — it's not that AWS's defaults are worse, it's that there are simply more defaults to get right. That distinction matters if you're deciding what to do about it, because “switch providers” isn't the takeaway; “know which of these six categories applies to your account” is.

The numbers worth remembering

• Weak IAM controls and missing logging/alerting showed up in the large majority of accounts studied, regardless of provider — this isn't an AWS-specific failure, it's a near-universal one.
• Permissive ingress rules — security groups open to sensitive ports from anywhere — were common enough to be one of the top findings overall.
• IAM policies that allow privilege escalation, often through a managed policy that looks narrower than it actually is, were flagged at a similarly high rate.

What we'd actually check this week

If you're running a small AWS footprint with no dedicated security hire, the useful move isn't reading the full report — it's pulling the three findings above and checking your own account against each one directly: run IAM Access Analyzer's unused-access and policy checks, pull every security group and grep for 0.0.0.0/0 on anything other than 80/443, and confirm CloudTrail and GuardDuty are both actually enabled rather than assumed to be.

The report's real value isn't the ranking — it's confirmation that these three categories are still where almost everyone, on every provider, is getting caught out. That's a much shorter list to act on than “AWS is risky.”