Key concepts

The unit is the cloud resource: an AWS ARN, an Azure resource ID, a Google resource name. Vendors bill on it, and each counts it differently:

The same estate can come out very differently under each, so comparing quotes starts with converting them to one unit.

Cloud identity is the other entity: people, roles, service accounts, workload identities and integration roles. Machine identities far outnumber people, though estimates run from 10 to 1 (Microsoft, 2023) to "up to 40,000" to 1 (Sysdig, 2025), which mostly shows the definitions differ. Microsoft's 2023 research found identities use about 1% of the permissions they're granted. Non-human identities are where cloud breaches run: old access keys, OAuth tokens, CI tokens and, in Microsoft's Storm-0558 case, a signing key. The scanner is one too: a CNAPP holds read rights, and often snapshot and encryption-key rights, in every account you connect.

Customers and businesses that a platform verifies are a different kind of identity, covered in Identity and trust; AI agents' identities are in AI agents: orchestration platforms.

A finding at AWS carries three separate states at once: a workflow status (new, notified, suppressed, resolved), a record state (active or archived) and a compliance result (passed, failed, warning or not available). They change independently. The detail I'd remember: a resolved finding goes back to new if the check fails again, while a suppressed one stays suppressed. A suppression is sticky and a fix is fragile.

Severity is a state too. A finding becomes critical when something next to it changes: a firewall rule opens, a role gains a permission, a bucket starts holding customer data. Graph-based tools recompute as the inputs change.

Credentials have a lifecycle that nobody closes. In Datadog's October 2025 data, 59% of AWS IAM users had an active access key more than a year old, and in the 2024 Snowflake breaches some stolen credentials dated back to 2020 and still worked. "Decommissioned" is the state most often missing.

Regulators add states of their own: an incident becomes "material" at the SEC or "major" under DORA, and a cloud provider becomes "designated" as critical in the EU and the UK.

There's no single system of record.

Drift is the gap between the repository and the cloud; staleness is the gap between the cloud and the graph. Retention is short by default: AWS Security Hub's older posture product deletes findings after 90 days active or 30 days archived, while PCI, SOC 2 and FedRAMP auditors usually want longer, so evidence gets exported to storage or a SIEM (the security team's log analysis system). And because Security Hub Extended and marketplace purchases land on the AWS bill, finance and FinOps teams see security spend alongside the CISO.

Policy comes from CIS benchmarks (prescriptive technical checks; AWS added version 5.0 of its AWS benchmark to Security Hub in October 2025, with 40 automated controls), the providers' own benchmarks, mappings to PCI or FedRAMP, custom rules, and preventive guardrails such as AWS service control policies and resource control policies, Azure Policy and Google organization policies. Detection dominates prevention in practice: in Datadog's 2025 data, 40% of AWS Organizations users had service control policies and 6% had resource control policies.

The metadata fix is my favourite example of a cheap rule left unapplied. Version 2 of the EC2 instance metadata service needs a session token, which blocks the request-forgery trick behind the Capital One breach. Datadog found it enforced on 49% of EC2 instances in 2025, up from 7% in 2022, while 82% of instances had used only version 2 in the previous two weeks and could have enforced it without breaking anything.

Regulators and insurers write rules too. New York now requires MFA for any individual accessing a covered firm's systems, and insurers increasingly reject text-message MFA and ask for phishing-resistant keys for administrators, endpoint detection and backups.

Dates I'd keep on a calendar as of October 2026:

Some changes have no date yet: SEC Item 1.05 is under pressure to be rescinded, the EU proposed NIS2 amendments on January 20, 2026, and the UK's Cyber Security and Resilience Bill is still in Parliament. And since December 2025, "CSPM" also names an AWS product, the old Security Hub.

The findings side is converging on a few shared formats:

• OCSF (the Open Cybersecurity Schema Framework) is the format for AWS's new Security Hub findings and for partner findings sold through Security Hub Extended. Shared formats make it cheaper to swap one tool for another, and they make whoever collects everyone's findings more valuable.
• CVE, CVSS, EPSS and KEV describe vulnerabilities: CVE names one, CVSS scores its severity, EPSS estimates how likely it is to be exploited, and KEV is CISA's catalog of vulnerabilities known to be exploited.
• CIS benchmarks define configuration checks, and MITRE ATT&CK names attacker techniques; GuardDuty maps its attack sequences to it.

The rest is plumbing: cross-account roles for reading, Jira, ServiceNow and Slack for ownership, Git for pull requests. The newest piece is MCP, the protocol AI agents use to call tools: Wiz offers its remediation agent over MCP, and Google's Model Armor screens MCP tool calls.

Outside parties are now the usual shape of a breach. The 2026 Verizon report, as summarized by others, found partners or vendors involved in 48% of breaches, up from 30%. The chains I'd keep in mind run from a contractor's laptop to Snowflake (2024), from a chat vendor's stolen tokens to Salesforce data to AWS keys (Salesloft Drift, 2025), and from a poisoned scanner to a CI pipeline to AWS keys (Trivy, 2026). The tools are counterparties too: Datadog's 2025 data found 12.2% of vendors' integrations into customers' clouds dangerously over-privileged.

One company now sits in several seats. Google runs a cloud, owns Wiz, owns Mandiant (whose report traced the Snowflake breaches to customers' credentials), publishes threat data from its own incidents and sells Model Armor. That's a lot of the story told and sold by one party, which I'd keep in mind when reading their reports.

Nobody licenses cloud security vendors; the rules arrive in layers.

A New York-licensed, SEC-listed lender on AWS answers to its bank regulators, NYDFS, the SEC, PCI DSS through its card processors, state breach laws, and GDPR and DORA if it operates in the EU. Compliance dashboards map one technical check to all of these; the auditors and the evidence they accept differ.

The GuardDuty case is the one I'd teach. Its Extended Threat Detection, on by default since December 2024, correlates events over a rolling 24 hours into a single critical "attack sequence" finding, and it ignores archived findings, including ones archived by suppression rules. A rule written to cut noise can blind the engine meant to catch the attack, which is why AWS advises reviewing suppression rules.

Rules reverse as well. The SEC's SolarWinds case was dismissed with prejudice on November 20, 2025, and the members of the US Cyber Safety Review Board, which had called Storm-0558 "a cascade of security failures", were dismissed in January 2025. Snowflake moved its MFA deadline twice, from November 2025 to August and then October 2026. And the UK's data regulator cut Capita's proposed £45 million fine to £14 million.

The customer carries almost all of it, and the contracts say so. AWS's customer agreement (updated August 14, 2026) says "You are responsible for properly configuring and using the Services" and caps AWS's liability at the fees paid for the service involved in the 12 months before the claim. Microsoft lists configurations, identities and data as the customer's in every column, though its page is "not intended to convey legal conclusions". Google says customers "always remain responsible for their access policies and data", and its "shared fate" program adds blueprints and an insurance channel without changing legal liability.

Snowflake is the case to watch. It's a defendant in federal multidistrict litigation in Montana, and October 2025 rulings let negligence and consumer-protection claims proceed on several tracks; two plaintiffs' claims against it were dropped in December 2025 after their companies settled. With no liability finding and no certified class, the theory that an optional-MFA default is negligence is alive and unproven, and I found no public case where a customer recovered breach losses from a cloud provider.

Providers pay in engineering instead: AWS shipped instance metadata version 2 in November 2019, about four months after Capital One, Snowflake is making MFA mandatory, and Microsoft made logs free after Storm-0558.