The most damaging cloud attacks of the last three months didn’t rise from sophisticated hacks, with firms instead falling victim to predictable, preventable identity failures, new analysis from ReliaQuest reveals.

The cybersecurity firm’s latest report, The Danger of Over-Privileged Cloud Identities, warns that rather than fearing zero-day assaults, security pros should instead worry more about identity compromise, which accounted for 44% of true-positive alerts over Q3’25.

ReliaQuest found that more than half (52%) of these identity-based alerts stemmed from privilege escalation, an unsurprising figure given that the firm claims 99% of cloud identities are significantly over-privileged.

The report warns that, as companies increasingly move their operations to the cloud, with data and applications regularly scattered across multiple platforms, attackers are sidestepping traditional network defences and simply logging in with leaked cloud keys and user credentials.

Describing this lacklustre security layer as a ‘critical point of failure’, ReliaQuest said that an abundance of excessive permissions makes this problem a lot worse, allowing attackers a lot of lateral movement, often into core areas. 

Meanwhile, computational issues like the misuse of virtual machines, containerised environments, and serverless functions drive another 43% of cloud security alerts, with incidents stemming from vulnerabilities like exposed APIs, unpatched software, or misconfigured policies.  

“As organisations have moved to the cloud, security strategies have shifted from guarding a fixed network perimeter to controlling access through user identities,” said the report.

“Threat actors can exploit this reality, using stolen cloud keys and credentials to walk into networks unimpeded and leverage over-privileged accounts to turn initial compromises into full-blown breaches.”

Attackers can use this stealth-first approach to become ghosts within the network, mimicking legitimate user activity to bypass standard alerts.

The report claims that threat actors like the now notorious Scattered Spider use real credentials and spoofed locations to make their malicious logins virtually indistinguishable from genuine ones, even when defenders are using advanced detection tools.

These identity-based attacks are also incredibly cheap for hackers to run. Compared to resource-heavy hacks like brute force assaults or large-scale phishing campaigns, identity exploitation is easy, with adversaries able to buy legit logins for as little as £1.50 on the dark web.

Recommended reading

• Can Europe ‘Trump-Proof’ Its Cloud Services?
• Security, Compliance, AI Concerns Driving Private Cloud Adoption
• What Top Trends Are Shaping the Future of Cloud?

While basic credentials like usernames and passwords are cheap, attackers can also purchase leaked access keys, often stolen from CI/CD pipelines or misconfigured environments, to gain initial access.

Adding to the danger, ReliaQuest points out that most companies now juggle thousands of identities across AWS, Azure, and Google Cloud as well as multiple SaaS applications, each one a potential chink in the armour. That’s especially true for those like AWS that offer pre-packaged roles (such as AdministratorAccess), granting hundreds of permissions by default.

“Organisations must realign their security strategies to treat identity as the true modern perimeter,” said ReliaQuest.

“Security teams should shift to a ‘zero standing privileges’ model built on the PoLP. At the user level, permissions should be granted through just-in-time authentication, where access is temporarily ‘checked out’ following MFA approval and expires automatically. 

“For access keys, which are commonly exploited for initial access, teams should enforce short-lived session tokens. These tokens offer similar security benefits as long-term access keys and can be tracked and revoked in shorter timeframes while supporting automated workflows.”