Intruder 2026 Index Shows AWS Exposed Services at 76% Versus Google Cloud at 8%

Intruder grouped misconfigurations into six categories from real account data. Weak IAM and missing logging hit 80-98% of accounts on AWS, Azure and Google Cloud alike. Divergence appears in network exposure and encryption: AWS leads in permissive firewalls at 83% and weak encryption at 49%, while Google Cloud records the lowest rates in five of six categories. Azure shows the highest rate of misconfigured services at 80%, driven by storage account key and public access issues. The pattern aligns with service count and default posture rather than user error alone. Google Cloud's Shared Fate model ships tighter network and encryption defaults, reducing the attack surface before customers configure anything. AWS's larger service surface creates more opportunities for exposed S3 buckets and open ACLs, confirmed by the 87% rate of S3 buckets not enforcing HTTPS. One documented case showed exposed credentials escalating to 19 principals in under ten minutes via overly permissive IAM. Azure storage accounts cluster multiple controls failures together, with key rotation, access keys and public network access each affecting over 60% of accounts. Entra ID accounts without MFA remain at 55%, echoing the 2024 Midnight Blizzard entry vector. Google Cloud issues concentrate almost entirely on IAM, consistent with its narrower service footprint. Procurement and incident data show organizations running multi-cloud workloads inherit these distinct risk profiles without unified visibility. The next observable shift will be whether AWS and Azure adopt stricter defaults on storage and network exposure in 2027 releases.