April 25, 2025

Top 10 Cloud Misconfigurations in 2025

Cloud misconfigurations remain the #1 cause of data breaches. Here are the top 10 mistakes security teams make:

  1. Public S3 Buckets: Accidentally exposing storage to the world.
  2. Open Databases: MongoDB, Elasticsearch, and Redis without authentication.
  3. Overly Permissive IAM: Wildcard permissions that violate least privilege.
  4. Unencrypted Storage: Data at rest without AES-256 or equivalent.
  5. Exposed APIs: Internal microservices reachable from the internet.
  6. Missing MFA: Root and admin accounts without second-factor.
  7. Default Credentials: Factory passwords on cloud appliances.
  8. Unpatched VMs: Long-running instances missing critical updates.
  9. Public Snapshots: Disk snapshots shared beyond the organization.
  10. Shadow Resources: Orphaned assets nobody owns or monitors.

ShadowSurface scans for all of these automatically, alerting you before attackers find them.