Report: 1 in 3 Easily Exploitable Vulnerabilities Found on Cloud Assets

CyCognito recently released new research highlighting critical security vulnerabilities across cloud-hosted assets, revealing that one in three easily exploitable vulnerabilities or misconfigurations are found on cloud assets. As organizations increasingly shift to multi-cloud strategies, the findings underscore significant security gaps that could provide attackers with potential footholds into networks.

Gartner predicts double-digit growth across all cloud segments in 2025, with organizations increasingly adopting multi-cloud strategies. This expansion coincides with rising security concerns, as researchers with Palo Alto Networks found that by the end of 2024, organizations suffered a 388 percent increase in cloud security alerts compared to 2023.

"While cloud computing offers tremendous benefits, we're seeing an alarming increase in serious security issues affecting cloud assets," said Emma Zaballos, Senior Researcher, CyCognito. "Organizations must understand the crucial difference between high-severity vulnerabilities and those that are easily exploitable—both present distinct risks that require targeted security approaches."

For this research, CyCognito analyzed anonymized, aggregated data across nearly five million internet-exposed assets – web applications, servers, domains, and more – that the company monitors, focusing on how vulnerabilities behave "in the wild" rather than just in controlled testing environments.

This research focused on the assets hosted on cloud platforms, rather than the cloud platforms themselves. While assets were aggregated by cloud hosting providers, further research is needed to understand why variance existed between different populations of assets.

Key findings:

  • Significant Vulnerability Variations Across Providers: 38 percent of assets hosted by Google Cloud were vulnerable to at least one security issue or misconfiguration, over 2.5x more than assets hosted by AWS (15 percent), while assets hosted by Azure ranked second with 27 percent.
  • Critical Vulnerabilities Present Across All Environments: Though uncommon, critical vulnerabilities (CVSS 9.0 or higher) were detected on assets hosted by all cloud providers, with assets hosted by Azure showing a slightly higher percentage (0.07 percent) compared to assets hosted by AWS and Google Cloud (0.04 percent). Assets hosted by other cloud providers showed approximately 10 times higher rates of critical vulnerabilities.
  • Easily Exploitable Vulnerabilities Most Common on Alternative Clouds: Over 13 percent of assets hosted on other clouds and 10 percent on other hosting providers had easily exploitable vulnerabilities, compared to 5 percent hosted on Google Cloud and just 2 percent on AWS and Azure.
  • Combined Risk Factors: Assets with both critical and easily exploitable issues were found across all providers, with AWS showing the lowest rate (0.02 percent) while alternative cloud and hosting providers showed rates ten times higher.
  • The research emphasizes the importance of comprehensive security testing beyond development environments. "Security teams must focus on testing applications after they're deployed, not just during development," added Zaballos. "Dynamic application security testing is crucial as it actively tests live assets, uncovering application vulnerabilities and misconfigurations that static tools miss."

The research comes as CyCognito announced a new partnership with Wiz to enhance protection of cloud environments. CyCognito enriches Cloud-Native Application Protection Platform (CNAPP) coverage by identifying externally exposed cloud assets and identifying vulnerabilities and misconfigurations using more than 80,000 active and passive tests. By taking an outside-in attacker’s perspective, CyCognito fills visibility gaps across sanctioned and unsanctioned cloud assets and enables security teams to focus on the most

critical vulnerabilities.

For more information on the research, please see the blog post.

Featured

  • Report: 47 Percent of Security Service Providers Are Not Yet Using AI or Automation Tools

    Trackforce, a provider of security workforce management platforms, today announced the launch of its 2025 Physical Security Operations Benchmark Report, an industry-first study that benchmarks both private security service providers and corporate security teams side by side. Based on a survey of over 300 security professionals across the globe, the report provides a comprehensive look at the state of physical security operations. Read Now

    • Guard Services
  • Identity Governance at the Crossroads of Complexity and Scale

    Modern enterprises are grappling with an increasing number of identities, both human and machine, across an ever-growing number of systems. They must also deal with increased operational demands, including faster onboarding, more scalable models, and tighter security enforcement. Navigating these ever-growing challenges with speed and accuracy requires a new approach to identity governance that is built for the future enterprise. Read Now

  • Eagle Eye Networks Launches AI Camera Gun Detection

    Eagle Eye Networks, a provider of cloud video surveillance, recently introduced Eagle Eye Gun Detection, a new layer of protection for schools and businesses that works with existing security cameras and infrastructure. Eagle Eye Networks is the first to build gun detection into its platform. Read Now

  • Report: AI is Supercharging Old-School Cybercriminal Tactics

    AI isn’t just transforming how we work. It’s reshaping how cybercriminals attack, with threat actors exploiting AI to mass produce malicious code loaders, steal browser credentials and accelerate cloud attacks, according to a new report from Elastic. Read Now

  • Pragmatism, Productivity, and the Push for Accountability in 2025-2026

    Every year, the security industry debates whether artificial intelligence is a disruption, an enabler, or a distraction. By 2025, that conversation matured, where AI became a working dimension in physical identity and access management (PIAM) programs. Observations from 2025 highlight this turning point in AI’s role in access control and define how security leaders are being distinguished based on how they apply it. Read Now

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.