Critical vulnerabilities found across all cloud providers

A new report from CyCognito highlights critical security vulnerabilities across cloud-hosted material, revealing that one in three easily exploitable vulnerabilities or misconfigurations are found on cloud assets.

Though uncommon, critical vulnerabilities (CVSS 9.0 or higher) have been detected on assets hosted by all cloud providers, with assets hosted by Azure showing a slightly higher percentage (0.07 percent) compared to assets hosted by AWS and Google Cloud (0.04 percent).

"While cloud computing offers tremendous benefits, we're seeing an alarming increase in serious security issues affecting cloud assets," says Emma Zaballos, senior researcher at CyCognito. "Organizations must understand the crucial difference between high-severity vulnerabilities and those that are easily exploitable -- both present distinct risks that require targeted security approaches."

The research finds that 38 percent of assets hosted by Google Cloud were vulnerable to at least one security issue or misconfiguration, over 2.5x more than assets hosted by AWS (15 percent), while assets hosted by Azure ranked second with 27 percent.

Vulnerabilities are more comon outside of the hyper-scale cloud providers. Over 13 percent of assets hosted on other clouds and 10 percent on other hosting providers had easily exploitable vulnerabilities, compared to five percent hosted on Google Cloud and just two percent on AWS and Azure.

Assets with both critical and easily exploitable issues were found across all providers though, with AWS showing the lowest rate (0.02 percent) while alternative cloud and hosting providers showed rates ten times higher.

"Security teams must focus on testing applications after they're deployed, not just during development," adds Zaballos. "Dynamic application security testing is crucial as it actively tests live assets, uncovering application vulnerabilities and misconfigurations that static tools miss."

The research comes as CyCognito has announced a new partnership with Wiz to enhance protection of cloud environments. CyCognito enriches Cloud-Native Application Protection Platform (CNAPP) coverage by identifying externally exposed cloud assets and identifying vulnerabilities and misconfigurations using more than 80,000 active and passive tests.

Image credit: Leowolfert/Dreamstime.com