There is no universally safest cloud provider. Intruder’s analysis of 3,000 organizations over the 12 months ending July 2026 found that Google Cloud had the lowest prevalence in four of six measured misconfiguration categories, while AWS had the highest prevalence in five categories and Azure led in misconfigured services. Those figures describe configuration findings in the study population, not the probability that an account will be breached.
The practical conclusion is more useful than a league table: every provider requires disciplined identity governance, least privilege, comprehensive logging, network controls and continuous posture management. Your existing skills, identity systems and ability to remediate quickly can matter as much as the provider’s defaults.
As an Amazon Associate I earn from qualifying purchases.
What the 2026 index measured
Intruder grouped findings from AWS, Microsoft Azure and Google Cloud into six categories: weak IAM controls, missing logging and alerting, misconfigured services, permissive firewalls, exposed services, and weak encryption. The dataset covers 3,000 organizations observed during the 12 months to July 2026.
The percentages are account-prevalence figures within that dataset. They are not breach rates, loss rates or the chance that a particular workload will be compromised. The public analysis does not publish provider-by-provider account counts, its sampling frame, weighting rules or raw records, so use the figures as directional evidence rather than a universal ranking of every customer.
#1 Best Overall
Cross-provider comparison at a glance
| Category | AWS | Azure | Google Cloud | What it means |
|---|---|---|---|---|
| Weak IAM controls | 97% | 90% | 87% | Identity and privilege weaknesses are widespread everywhere. |
| Missing logging and alerting | 98% | 80% | 82% | Detection coverage is a near-universal gap. |
| Misconfigured services | 68% | 80% | 37% | Azure has the highest prevalence in this category. |
| Permissive firewalls | 83% | 45% | 34% | AWS shows substantially more permissive network rules in the index. |
| Exposed services | 76% | 64% | 8% | Google Cloud recorded the lowest prevalence. |
| Weak encryption | 49% | 35% | 8% | Encryption-related findings were least prevalent in Google Cloud. |
Google Cloud therefore leads on the six-category snapshot, but its 87% weak-IAM figure still means identity risk is common. AWS’s 98% missing-logging result and 97% weak-IAM result show why a broad service catalog does not automatically produce safe operations. Azure’s lower firewall and encryption figures do not offset its 80% misconfigured-services result.
How risk differs by provider
AWS: broad capability, complex privilege and network exposure
AWS had the highest prevalence in five of the six categories in this index. Its broad service surface and detailed IAM policy model give teams considerable control, but they also create more places for permissions, network paths and account settings to drift.
The most common AWS-specific findings were:
- S3 not enforcing HTTPS: 87% of accounts in the study.
- Permissive ingress to sensitive ports through ACLs: 84%.
- Overly permissive network ACLs: 83%.
- IAM policies allowing privilege escalation: 83%.
- VPC endpoints not enabled for EC2: 82%.
The same analysis identified account-level public-access settings, root-account management, inappropriate IAM attachments and key-rotation gaps as recurring issues. These are not isolated service bugs: a forgotten root credential, an attached policy that permits escalation or an unrotated key can undermine otherwise careful workload configuration.
Rank #2
AWS priorities
- Block public access centrally for S3, then create narrowly scoped exceptions with an owner and expiry.
- Review IAM policies for wildcard actions, resource-wide grants and paths that let a principal change its own permissions.
- Put root-account credentials under centralized control, require strong MFA and remove routine root usage.
- Review network ACLs and security-group rules for public access to administrative and database ports.
- Use private connectivity such as VPC endpoints where workloads do not need to traverse the public internet.
- Rotate access keys, prefer short-lived role credentials and alert on new long-lived keys.
- Send CloudTrail and relevant service logs to protected, centralized storage with alerts for privilege, network and data-access changes.
AWS describes cloud security as a shared responsibility: it secures the underlying cloud infrastructure while customers remain responsible for identities, data, configurations and workloads. Its Trust Center provides the provider’s security guidance, but the customer still has to implement and verify controls.
Azure: storage, Entra identity and secret lifecycle
Azure recorded the highest prevalence of misconfigured services at 80%. Its most common findings concentrated on storage accounts, Microsoft Entra ID and virtual-machine protections:
- Storage-account key rotation not enabled: 67%.
- Storage-account access keys enabled: 66%.
- Storage-account public network access enabled: 61%.
- Entra users without MFA: 55%.
- Trusted Launch not enabled: 45%.
Key Vault secret-expiry and public-access controls were also frequent gaps. Storage access keys are particularly important because they can provide broad, durable access when they are copied into scripts or applications. Entra findings can have impact beyond Azure itself: the same identity platform may govern Microsoft 365, other SaaS applications and on-premises resources.
Azure priorities
- Disable public network access on storage accounts and Key Vault unless a documented business path requires it; use private endpoints and narrowly scoped network rules.
- Move applications from account keys to managed identities or other short-lived credentials where supported.
- Rotate remaining storage keys on a defined schedule, track every consumer and revoke unused keys.
- Enforce phishing-resistant or strong MFA for all Entra users, with special protection for administrators and emergency accounts.
- Set Key Vault secret-expiry policies, alert before expiration and remove secrets that no workload uses.
- Enable Trusted Launch for supported virtual machines and verify that the chosen image and workload are compatible.
- Centralize Entra, Azure resource and data-plane logs, then alert on role changes, consent grants, key use and public-access changes.
Google Cloud: lower category prevalence, but identity and SSH controls still matter
Google Cloud had the lowest prevalence in four categories and particularly low figures for exposed services (8%) and weak encryption (8%). That should not be interpreted as an absence of identity risk: weak IAM still affected 87% of accounts, only slightly below Azure and AWS in the same index.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The leading Google Cloud findings were:
- OS Login MFA not enabled: 77%.
- OS Login not enabled: 76%.
- Unused service accounts: 75%.
- Overly permissive service accounts: 53%.
- Permissive ingress to sensitive ports: 34%.
Key-rotation gaps, default networks, project-wide SSH keys and missing Shielded VM controls followed. Unused service accounts are an especially important lifecycle problem: they preserve credentials and permissions after the workload or employee that created them has disappeared.
Google Cloud priorities
- Enable OS Login and require MFA for administrative SSH access.
- Replace project-wide SSH keys with centrally managed, short-lived access and remove keys that no longer have an owner.
- Inventory service accounts, disable or delete unused accounts and assign an owner and purpose to every remaining account.
- Reduce service-account roles to the smallest set of actions and resources required; watch for user-managed keys and rotate or eliminate them.
- Replace default networks with deliberately designed subnets, routes and firewall rules.
- Restrict ingress to sensitive ports and use private access paths for internal services.
- Enable Shielded VM protections where supported and verify that encryption and key-management settings meet the workload’s requirements.
Why identity and logging dominate the risk
Threat data explains why the index’s identity and telemetry findings deserve priority. The Google Cloud Office of the CISO and Mandiant reported that identity issues were used for initial access in 83% of incidents involving major cloud and SaaS-hosted environments in the second half of 2025. The same analysis found that data was targeted in 73% of cloud-related incidents. Attackers often use legitimate credentials and cloud-native permissions, so a technically secure network can still expose data when an identity is overprivileged.
Rank #4
In a separate 2025 report covering the first half of that year, weak or absent credentials accounted for 47.1% of observed initial-access vectors, misconfigurations for 29.4% and API or user-interface compromises for 11.8%. These are percentages of observed incident engagements, not predictions for every customer, but they reinforce the same control order: protect identities, reduce standing privilege, detect changes and monitor data movement.
A provider-neutral security baseline
Whether you run one cloud or several, establish controls that travel with the organization rather than with a particular console.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Define an identity standard. Require MFA, preferably phishing-resistant methods for administrators; use least-privilege roles; remove shared accounts; and set an approval path for privileged access.
- Prefer short-lived credentials. Use workload identities, roles or managed identities instead of embedded keys. Give every service account or role an owner, purpose and review date.
- Centralize audit evidence. Enable control-plane and data-plane logs, send copies to a protected account or project, set retention appropriate to legal and incident-response needs, and alert on privilege, key, public-access and logging changes.
- Constrain network exposure. Inventory every internet-facing endpoint, deny sensitive ports by default, and document any exception with an owner and expiration date.
- Protect storage and encryption keys. Disable anonymous or public access unless explicitly required, use customer-managed keys where the risk model calls for them, and automate rotation and expiry checks.
- Scan continuously. Cloud configurations change faster than annual audits. Use posture or exposure management to detect drift, assign each finding to a named team and track closure evidence.
- Test recovery and data monitoring. Verify that backups can be restored, that logs survive a compromised production account and that unusual data reads or transfers generate an investigation.
Choosing a provider for your organization
The index can inform a decision, but it cannot choose a provider on its own. Compare each candidate on eight operational axes:
- IAM complexity and privilege control: Can your team model roles, approvals and service identities correctly?
- Logging and alerting: Are the required logs available, affordable to retain and easy to route into your detection platform?
- Network defaults: How quickly can teams discover and close public paths and sensitive-port exposure?
- Storage and public-access controls: Can policy prevent accidental anonymous access before deployment?
- Encryption posture: Are keys managed, rotated and recoverable in a way your compliance model accepts?
- Identity integration and MFA: Does the provider fit your workforce directory, privileged-access process and phishing-resistant authentication plan?
- Remediation speed: Can owners fix findings within the time your risk appetite allows?
- Operational fit: Do your engineers already understand the provider’s services, policy language and incident procedures?
These questions matter in multi-cloud environments. The Cloud Security Alliance and Tenable reported that 63% of organizations use more than one cloud provider, while 59% named insecure identities and risky permissions as their top cloud-infrastructure risk. A common baseline, shared ownership model and consistent detection pipeline reduce the chance that a team treats one provider’s controls as a substitute for another’s.
Remediation speed is a security control
Intruder’s index found that remediation typically took 7–16 days for smaller organizations, rose to about 35 days among organizations with 1,000–5,000 employees, and was around 10 days for organizations with more than 10,000 employees. Those are observed organizational ranges, not service-level guarantees. The pattern suggests that size alone does not determine speed: ownership, automation, change control and the ability to prioritize critical findings are decisive.
Set severity-based deadlines, route findings to the team that can change the resource, and require evidence when a finding is closed. Exceptions should have a business justification, compensating controls and an expiry date. Measure both time to acknowledge and time to remediate; a dashboard that only counts open findings can hide a growing queue.
AI workloads add another reason to tighten the basics
The Cloud Security Alliance and Tenable found that 34% of organizations with AI workloads reported an AI-related breach. The figure does not identify a single provider as the cause, but AI systems often combine sensitive data, broad service permissions and automated pipelines. Apply the same identity, logging, network and data-movement controls to model-training jobs, notebooks, vector stores and inference endpoints, and review whether service accounts can access more data than the model actually needs.
Bottom line: “most secure” depends on the controls you can operate
On Intruder’s 2026 snapshot, Google Cloud looks strongest on aggregate misconfiguration prevalence, AWS shows the broadest and most severe exposure across the measured categories, and Azure’s standout weakness is misconfigured services, especially around storage and identity. None of those statements makes a provider intrinsically safe or unsafe. The winning environment is the one in which your organization can enforce MFA and least privilege, prevent public exposure, collect trustworthy logs, rotate credentials and close findings quickly.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
