Free tools Windows power users keep installed
One-click scans. No signup required.
A cloud asset inventory tells you what exists. To judge what an attacker might reach, you also need to understand how those assets connect to identities, permissions, network access, vulnerabilities, and sensitive data. That relationship context makes an inventory useful for prioritization; it does not make the inventory itself unnecessary.
What does a “relationship problem” mean in cloud security?
Cloud environments contain more than virtual machines, databases, storage buckets, and other resources. They also contain human and workload identities, permissions granted to those identities, network connections, exposed services, vulnerabilities, and data classifications. The security question is not only “What do we have?” but also “Which identity can reach which resource, by what route, and what could it access next?”
Microsoft describes the cloud security graph in Defender for Cloud as a graph-based context engine. Its documented inputs connect cloud resources with relationships such as permissions and network reachability, as well as exposure, vulnerabilities, and sensitive targets. Those links can reveal combinations that a flat inventory or a pile of separate alerts may not make obvious.
This is an argument for adding context to inventory, not replacing asset discovery. If a team does not know a resource exists, it cannot reliably assess its configuration, ownership, or role in a possible path.
#1 Best Overall
How an attack path connects an exposed resource to sensitive data
Microsoft Learn defines an attack path as “a series of steps a potential attacker uses to breach your environment and access your assets.” In practice, an analysis might identify a chain like this:
- An internet-exposed resource has a vulnerability that could provide an entry point.
- An identity or permission associated with that resource can access another cloud resource.
- That access enables plausible lateral movement through the environment.
- The chain eventually reaches a critical asset, such as a database containing sensitive information.
This is a risk-analysis model, not a claim that every breach follows this sequence or that a flagged path proves an attacker used it. A product’s findings depend on the configuration and evidence it observes in a particular environment. Microsoft says Defender for Cloud prioritizes paths using factors including internet exposure, permissions, and lateral movement, and documents configuration analysis, reachability checks, and suggested remediations for its feature.
Why the cloud service model changes the security picture
Cloud providers and customers divide security work differently depending on the service. The customer’s retained responsibilities matter to relationship analysis: a provider-managed platform does not automatically mean that data access, identity permissions, or customer configuration are safe.
| Service model or example | Provider role | Customer responsibilities highlighted by the sources |
|---|---|---|
| IaaS, such as Amazon EC2 | The provider secures the underlying cloud infrastructure. | The customer manages the guest operating system, application software, security-group firewall configuration, data, identities, and access controls. |
| Abstracted services, such as Amazon S3 and DynamoDB | AWS operates more of the infrastructure and platform layers. | The customer remains responsible for data handling and classification, encryption choices, and appropriate IAM permissions. |
| PaaS and SaaS | The provider manages more of the underlying stack than in IaaS; the exact boundary varies by service. | Microsoft’s responsibility matrix assigns customer data, configurations and settings, and identities and users to the customer across on-premises, IaaS, PaaS, and SaaS. Other duties vary by model. |
These are illustrations, not a substitute for the responsibility terms of a particular service. Microsoft presents its matrix as governance guidance about who configures, operates, and monitors controls; it says the matrix is not legal advice and does not change contractual agreements. AWS frames the split as “Security of the Cloud” and “Security in the Cloud,” with customer duties dependent on the services selected.
Rank #3
What Microsoft’s multicloud figures do—and do not—show
Microsoft’s May 29, 2024 Security Blog summarized analysis tied to Microsoft security-product usage and its 2024 State of Multicloud Risk Report. These vendor-reported figures can illustrate why identity and relationship context deserve attention, but they are not an independent, representative estimate of every organization’s cloud risk.
| Microsoft-reported figure | Scope and qualification |
|---|---|
| 86% of organizations had adopted a multicloud approach. | Reported in Microsoft’s 2024 report summary; retain the report context rather than treating it as a current universal rate. |
| More than 50% of cloud identities had access to all permissions and resources. | Microsoft’s analysis of its cloud-security product usage, describing 2023 data; not a universal prevalence estimate. |
| An average of 351 exploitable attack paths to high-value assets per multicloud estate. | Microsoft’s 2024 report summary; a reported average for the estates analyzed, not a prediction for any individual environment. |
| More than 6.3 million exposed critical assets across organizations. | Microsoft’s 2024 report summary; a product-analysis figure, not a count established for all cloud environments. |
| 83% of identities were workload identities, and 40% of those workload identities were inactive. | Microsoft reported these figures for identities in Entra Permissions Management in 2024. “Inactive” meant no login or permission use for at least 90 days. |
The figures point to useful questions for a security team—whether permissions are broader than needed, whether machine identities remain active and owned, and which exposed paths lead to critical assets. They do not establish that a particular organization has the same conditions.
How to turn relationship context into practical risk reduction
- Establish what exists. Maintain an inventory of cloud resources, their owners, environments, and business purpose. A graph is only as useful as the resource and configuration context available to it.
- Map identities to permissions and resources. Include both people and workload identities. Review what each identity can do and which resources it can reach, rather than evaluating permissions as isolated policy text.
- Trace plausible routes to critical assets. Start with externally reachable entry points and examine vulnerabilities, access rights, network reachability, and possible lateral movement toward sensitive systems.
- Validate the finding and its assumptions. Confirm that the resource, identity, permission, and network relationship are real and current. A detected path is a potential route to investigate, not proof of exploitation.
- Choose a remediation that breaks the path. Depending on the finding, that may mean fixing a vulnerability, removing unnecessary exposure, reducing an identity’s permissions, or changing access to a critical resource. Recheck whether the path remains after the change.
- Assign an owner and track the result. Cloud and application teams need clear responsibility for the control, a way to verify implementation, and a process for handling exceptions.
How to build ownership and least privilege into cloud work
AWS Prescriptive Guidance recommends distributing security ownership between cloud and application teams, translating requirements into controls, documenting developer guidance, and creating reusable artifacts. Its examples include least-privilege access for application identities, IAM roles, avoiding policy wildcards, scanning policies, and reusable infrastructure as code.
AWS also recommends improving least privilege through identity and access management practices that cover both human and machine identities. Operationally, that means treating workload permissions as part of application design and review—not as a one-time setup task detached from the software that uses them.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Best Value
What to look for in a cloud security process or tool
There is no established universal best product or independent head-to-head performance comparison in the sources cited here. Evaluate a process or tool against the work your team needs to do:
- Does it connect inventory with identities, permissions, internet exposure, network links, vulnerabilities, and sensitive targets?
- Can analysts trace a plausible route from an entry point to a critical resource and see why that route was prioritized?
- Does it account for differences among cloud providers and service models, including controls the customer still owns?
- Can the team validate findings and apply a specific remediation that breaks a path, rather than simply collecting another disconnected alert?
- Can ownership, least-privilege requirements, and policy review be incorporated into application workflows?
Use those criteria to judge whether a graph or analysis process helps answer the operational question: what can reach a high-value asset, through which relationships, and what change would reduce that risk?
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
