#USA #Cloud Security #Palo Alto #CyCognito #Vulnerabilities

CyCognito Identifies Alarming Security Gaps in Cloud Assets

In a recent report published by CyCognito, significant vulnerabilities across cloud-hosted assets were exposed, revealing a startling statistic: one in three cloud assets possess easily exploitable security flaws or misconfigurations. As more organizations advance towards multi-cloud strategies, these findings highlight pressing security risks that could act as entry points for potential cyber-attacks.

With Gartner forecasting remarkable growth across all cloud segments in 2025, the transition to multi-cloud approaches is increasingly prevalent. However, parallel to this expansion are rising concerns regarding security, as evidenced by research from Palo Alto Networks, which documented a staggering 388 percent increase in cloud security alerts by the end of 2024 in comparison to the previous year.

Emma Zaballos Weighs In

"While the advantages of cloud computing are numerous, the alarming rise in serious security concerns surrounding cloud assets cannot be ignored," remarked Emma Zaballos, a Senior Researcher at CyCognito. "It's crucial for organizations to differentiate between high-severity vulnerabilities and those that are easily exploitable, as they present unique risks necessitating tailored security strategies."

To uncover these risks, CyCognito analyzed anonymized data spanning nearly five million internet-exposed assets—including web applications, servers, and domains—monitoring how these vulnerabilities manifest in real-world scenarios rather than merely in controlled testing settings.

Key Discoveries

1. Vulnerability Disparities Among Providers: The report discloses that 38 percent of assets under Google Cloud encountered at least one security issue or misconfiguration, a figure that is over 2.5 times greater than the 15 percent observed in assets hosted by AWS. Following Google was Azure with 27 percent.

2. Presence of Critical Vulnerabilities: Though infrequent, critical vulnerabilities (those categorized with a CVSS score of 9.0 or higher) were present on assets across all major cloud providers. Azure exhibited a slightly higher occurrence rate of these vulnerabilities at 0.07 percent, compared to 0.04 percent for both AWS and Google Cloud, while other providers demonstrated approximately ten times higher rates of such critical vulnerabilities.

3. Proliferation of Easily Exploitable Vulnerabilities: Notably, assets hosted on alternative clouds showed over 13 percent having easily exploitable vulnerabilities, while 10 percent of those on other non-cloud hosting providers experienced the same. Conversely, the rates for Google Cloud were at 5 percent, while assets from AWS and Azure recorded just 2 percent.

4. Combined Risks Across Providers: Assets exhibiting both critical and easily exploitable vulnerabilities were found across all cloud platforms, with AWS showing the least prevalence at 0.02 percent. In contrast, alternative cloud and hosting providers displayed rates ten times higher.

Emphasis on Security Testing

The findings underscore the necessity of implementing thorough security testing beyond development environments. As Zaballos noted, "Security teams must prioritize testing applications in the live environment, not just during the initial development phase. Dynamic application security testing is vital for actively identifying vulnerabilities and misconfigurations in real time, which static tools might overlook."

As an additional measure towards combating these vulnerabilities, CyCognito has recently partnered with Wiz to bolster the protection of cloud environments. Their collaboration enhances the coverage provided by the Cloud-Native Application Protection Platform (CNAPP) by identifying externally exposed assets and pinpointing vulnerabilities through a series of over 80,000 active and passive tests. By adopting an attacker’s perspective, CyCognito aims to bridge visibility gaps across allowed and disallowed cloud assets, allowing security teams to concentrate on addressing the most critical vulnerabilities.

For further information regarding the insights gained from the study, view here.

About CyCognito

CyCognito operates an exposure management platform designed to mitigate risks by identifying, testing, and prioritizing security flaws. This platform analyzes billions of websites, cloud applications, and APIs using advanced AI technologies to pinpoint crucial risks and guide their remediation efforts. A diverse array of clients—including startups, government entities, and Fortune 500 companies—lean on CyCognito for securing their environments against escalating threats.