Cloud security (CNAPP): posture, workloads and permissions
07
Rules and risks
5 min read · Chapter 7 of 10
How the rules work
Nobody needs a licence to sell cloud security. The rules land on the breached company, on buyers such as US federal agencies, and since 2025 on the big clouds.
Disclosure. Listed US companies must file an 8-K under Item 1.05 within four business days of deciding a cyber incident is material. Many file under the voluntary Item 8.01 instead: in the two years to May 2026, 29 issuers filed under 1.05 and 50 under 8.01. The SEC fined four companies about $1-4 million each in October 2024 over misleading disclosures, then dropped its case against SolarWinds and its CISO on November 20, 2025. Trade groups want Item 1.05 rescinded, though I found no proposal as of October 2026, and US federal pressure on breach disclosure looks to have peaked in 2024.
| Rule | Who it covers | Clock |
|---|---|---|
| SEC Item 1.05 | US listed companies | 4 business days after deciding an incident is material |
| NYDFS Part 500 | New York banks, insurers, money transmitters | 72 hours after determining an incident occurred |
| GDPR and UK GDPR | Controllers of EU and UK personal data | 72 hours to the regulator |
| NIS2 | EU essential and important entities, cloud providers included | Early warning in 24 hours, notification in 72, final report in a month |
| DORA | EU financial firms | Initial notice within hours of classifying a major incident; final report in a month |
| HIPAA | US covered entities and their vendors | Within 60 days of discovery |
New York. The final phase of NYDFS Part 500 took effect on November 1, 2025: MFA for any individual accessing covered systems, and a full asset inventory. Penalties run $250,000-2 million an order (PayPal and a New York dental benefits company paid $2 million each in 2025, the latter partly for annual certifications that turned out false), and they can't be paid from insurance.
EU and UK. DORA, the EU's operational resilience law for financial firms, has applied since January 17, 2025. On November 18, 2025 the EU's financial supervisors designated 19 critical technology providers, including AWS, Google Cloud, Microsoft and Oracle, and the UK designated the same four from July 13, 2026. Both regimes are about outages and concentration more than breach liability; banks stay responsible for their own technology risk. NIS2 treats cloud providers as essential entities, with fines up to €10 million or 2% of turnover, and the UK's data regulator fines missing MFA (Capita £14 million, Advanced £3.07 million).
Standards and buyers. PCI DSS 4.0.1 requires critical security patches within a month of release and a responsibility matrix for each service provider. FedRAMP's 2026 rules set fix windows by how exposed and exploitable a vulnerability is, from 12 hours at the top tier to as long as 192 days at the bottom, required from December 7, 2026, and its consolidated rules replace narrative security plans with machine-checked indicators from January 1, 2027. CISA's BOD 25-01 (December 17, 2024) was the first binding US federal mandate on SaaS settings, and FTC orders against Chegg (shared AWS root credentials without MFA) and GoDaddy read like a posture checklist.
Insurance. Global cyber premium was about $15-16 billion in 2025. Lloyd's has required exclusions for state-backed attacks since March 31, 2023, and long cloud outages often fall inside waiting periods of 8-12 hours, so they go largely uninsured.
What mistakes cost
IBM's 2026 survey put the average breach at a record $4.99 million worldwide, up 12%, and $11.5 million in the US. Fines are small next to that: NYDFS orders run up to about $2 million and SEC penalties $1-4 million, while class actions and the incident itself dominate. The cases below show who actually paid.
| Case | What happened | Who paid |
|---|---|---|
| Capital One, 2019 | A misconfigured web application firewall let an attacker make a server fetch its role credentials from the instance metadata service; the role could read S3; about 106 million people affected | Capital One: an $80 million OCC penalty, a $190 million class settlement and $100-150 million of 2019 costs, against a $400 million insurance tower. AWS, also sued, paid nothing on record |
| Snowflake customers, 2024 | Passwords stolen by infostealer malware, often years earlier, with no MFA, no rotation and no network allow list; about 165 organizations notified | The customers: AT&T a $177 million settlement covering two breaches (final approval pending) and a reported ransom of about $370,000; Advance Auto Parts $10 million; Neiman Marcus $3.5 million |
| Microsoft Storm-0558, 2023 | Attackers forged tokens with a stolen 2016 Microsoft consumer signing key; 22 organizations and over 500 people | Microsoft, in engineering and reputation: no fine, free logs for customers, a company-wide security program |
| Trivy and the European Commission, 2026 | Attackers poisoned Aqua's open-source scanner Trivy on March 19, 2026; a copy in the Commission's CI pipeline exposed an AWS key, and the attackers added a key to an existing user and took about 340 GB | Not quantified; 71 hosting clients of the Europa.eu service affected; credentials revoked |
| LiteLLM, 2026 | An unpinned Trivy in LiteLLM's CI leaked a package-publishing token, and the attackers published a backdoored LiteLLM that harvested cloud and Kubernetes credentials | Not quantified; every downstream user rotates keys |
Capital One is the textbook toxic combination: an exposed app, a reachable metadata service and a role with too much access. Snowflake is the textbook identity case: Mandiant found no breach of Snowflake's own environment, and at least 79.7% of the accounts used had credentials exposed in earlier infostealer leaks. One attacker pleaded guilty on August 5, 2026, with sentencing set for October 27, 2026. Storm-0558 is the one customers couldn't have prevented with posture; US agencies spotted it only because they paid for a premium log tier, a story told in Observability: metrics, logs and traces.
Trivy is the newest pattern, and the most uncomfortable for this industry, because the security tool became the way in. The Commission detected suspicious AWS API activity on March 24, five days after the key was stolen, and CERT-EU tied the breach to the Trivy compromise with high confidence.
Smaller patterns repeat: Microsoft AI researchers published a storage token on GitHub that opened 38 TB of data in 2023, and attackers who steal cloud keys often run hosted AI models on the victim's bill, called LLMjacking, at reported costs above $100,000 a day.