"We moved to the cloud, so security is handled" is a sentence that precedes a lot of incidents. The cloud does not remove your responsibility. It relocates it, and the relocation is precise enough to be worth understanding.
Why misconfiguration dominates
Cloud platforms are enormously configurable, and defaults are chosen to make things work rather than to be maximally restrictive.
A storage bucket set to public because it was quicker during development. A database with a permissive network rule added to unblock a deploy. An access key issued with broad permissions because narrowing them took time.
None of these are provider failures. All of them are common, and each is a single configuration line.
The most common serious finding in cloud audits remains a storage location readable by anyone with the URL. It is usually months old and nobody remembers creating it.
The perimeter dissolves, identity takes over
Traditional security assumed a boundary: inside the network was trusted, outside was not. Firewalls guarded the edge.
In cloud environments there is no meaningful edge. Services are reachable over the internet by design, staff work from anywhere, and integrations connect systems across organisations.
So the primary control becomes identity — who can do what, verified strongly, with permissions scoped to the minimum. Multi-factor authentication on privileged accounts is not a hardening extra in this model; it is the model.
Where cloud is genuinely better
It is worth saying plainly, because the honest answer is not that cloud is riskier.
- Infrastructure patching happens without you, and it happens promptly.
- Encryption at rest and in transit is available by default and easy to enable.
- Logging and audit trails are comprehensive if you switch them on.
- Recovery and redundancy are achievable at a cost that on-premise cannot match.
- Configuration can be expressed as code, reviewed, and rebuilt identically.
Where it is less forgiving
A misconfiguration on a server in a cupboard is exposed to whoever can reach the network. The same misconfiguration in a cloud environment may be exposed to the entire internet, immediately, with no additional step.
The blast radius of a careless change is larger, and the speed at which automated scanning finds it is measured in minutes.
That is the real trade: better defaults, less tolerance for carelessness. Both halves are true and vendors tend to publish only the first.
A practical starting checklist
- Audit every storage location for public access — start here, today.
- Enable MFA on all privileged accounts without exception.
- Review access keys, remove unused ones and scope the rest down.
- Turn on provider-native logging and confirm retention meets your needs.
- Move configuration into infrastructure as code so changes are reviewable.
- Confirm what your provider actually backs up, and test restoring it.