Cloud adoption and cybersecurity used to be separate conversations. One team chose providers and migrated workloads; another team was asked to secure the result afterwards. That sequence no longer works. In the cloud, security is built from the same configuration, identity and automation decisions that make up the architecture itself, so a cloud strategy without a security strategy is incomplete by definition.
The goal was never simply to migrate. It is to run a resilient environment that protects data, meets compliance obligations and stands up to capable attackers. The good news is that the major cloud platforms provide excellent security building blocks. The challenge is that most cloud incidents come from how customers use those blocks, not from failures of the provider.
Where cloud breaches actually come from
The most common causes of cloud security incidents are not exotic. They are misconfiguration, weak identity controls and too much trust in third parties.
Misconfiguration includes storage buckets left open to the internet, databases exposed without authentication, overly broad firewall rules and logging that was never enabled. Gartner predicted years ago that through 2025, 99 percent of cloud security failures would be the customer’s fault, and incident reports since have largely borne that out.
Identity is the other major weakness. In the cloud, a stolen password or access key is often all an attacker needs, because there is no internal network perimeter to cross. The 2024 campaign against customers of the Snowflake data platform is a clear example: attackers used credentials stolen by infostealer malware to log in to roughly 165 customer accounts that did not enforce multi-factor authentication, and exfiltrated large volumes of data. The platform itself was not breached. The customers’ identity controls were.
The stakes are significant. IBM’s 2025 Cost of a Data Breach report put the global average cost of a breach at 4.44 million dollars and the US average above 10 million dollars.
The shared responsibility model
Every cloud provider publishes a shared responsibility model. The provider secures the physical data centers, hardware, and the underlying infrastructure. The customer secures what they build and configure on top: identities and access, data, network rules, operating systems on virtual machines, and application code.
The split shifts by service type. With infrastructure as a service, you manage a great deal, including patching servers. With software as a service, such as Microsoft 365 or Salesforce, the provider runs almost everything, but you remain responsible for who has access, how data is shared, and how the service is configured. Many organizations misunderstand this last point and assume a SaaS provider handles security settings on their behalf.
Zero trust and identity as the new perimeter
Zero trust is the design principle best suited to the cloud: never grant access based on network location, verify every request based on identity, device and context, and give each user and workload only the access it needs.
In practice that means strong multi-factor authentication for every human account, preferably phishing-resistant methods such as passkeys or security keys; conditional access policies that consider device health and location; short-lived credentials for workloads rather than long-lived access keys; and regular reviews that remove unused permissions. Identity logs become the most important security telemetry you have.
AI-driven detection and automation
Cloud environments change constantly, which makes manual review impractical. Cloud security posture management (CSPM) tools continuously compare configurations against benchmarks such as the CIS Foundations Benchmarks and flag drift. Cloud detection and response tools apply machine learning to identity and API activity to spot unusual behavior, such as a user suddenly downloading large volumes of data from a new location.
AI helps most with triage: grouping related alerts, summarizing what happened and suggesting next steps. It does not replace a well-designed baseline. An environment with thousands of misconfigurations will generate thousands of alerts no matter how intelligent the tooling.
Building a secure cloud foundation
These steps address the causes behind most real incidents, in rough priority order:
- Enforce MFA everywhere. Require it for every user, including administrators, contractors and service accounts that support it. Block legacy authentication protocols that bypass it.
- Inventory accounts, subscriptions and SaaS tenants. You cannot secure what you do not know exists. Include shadow IT and SaaS integrations. See our article on SaaS supply chain and OAuth attacks.
- Apply secure configuration baselines. Use CIS benchmarks or CISA’s Secure Cloud Business Applications (SCuBA) baselines for Microsoft 365 and Google Workspace, and monitor continuously for drift.
- Centralize logging. Turn on audit logging for every account and service, and retain logs long enough to investigate incidents.
- Reduce standing privilege. Replace permanent administrator rights with just-in-time elevation and remove unused permissions.
- Encrypt and back up data. Use provider encryption with appropriate key management, and keep immutable backups that ransomware cannot delete.
- Define infrastructure as code. Templates that are reviewed and scanned before deployment prevent misconfigurations rather than detecting them afterwards.
- Rehearse incident response. Practice how you would revoke credentials, isolate workloads and restore data in your specific cloud platforms.
The main trade-off is effort versus convenience. Strict identity policies and change controls add friction for administrators and developers. That friction is small compared with the cost of an exposed database or a compromised administrator account.
Compliance in the cloud
Frameworks such as HIPAA, PCI DSS, SOC 2 and CMMC all apply to data in the cloud, and auditors increasingly expect evidence of continuous monitoring rather than annual snapshots. Cloud-native tools make that evidence easier to produce if logging and configuration baselines are in place from the start. Our cybersecurity compliance and regulatory framework services map cloud controls to the frameworks you report against. For a broader view of how cloud, data and security intersect, read why cybersecurity, cloud and big data are inseparable.
Frequently asked questions
Is the cloud more secure than on-premises infrastructure?
The major cloud platforms offer stronger physical and infrastructure security than most organizations can build themselves. Whether your environment is more secure depends on how you configure identities, data access and monitoring, which remain your responsibility.
What is the single most important cloud security control?
Multi-factor authentication on every account, ideally phishing-resistant. Stolen credentials are among the most common ways attackers gain access to cloud environments.
Do we need a separate security tool for each cloud provider?
Not necessarily. Native tools from each provider are a good starting point. Organizations using multiple clouds or many SaaS applications often add a cross-platform posture management tool to get one consistent view.
Secure your cloud from the start
Delana Technologies helps businesses design, migrate and harden cloud environments with identity, configuration and monitoring controls built in. To review your cloud security posture, call 239.414.5126 or contact us.
Sources: IBM, Cost of a Data Breach Report 2025; Mandiant, “UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion” (June 2024); Gartner, “Is the Cloud Secure?” (2019); CISA Secure Cloud Business Applications (SCuBA) project; CIS Foundations Benchmarks; AWS, Microsoft and Google shared responsibility documentation.