According to Infosecurity Magazine, identity weaknesses are now the top source of cloud security risk, with ReliaQuest’s Q3 2025 threat report revealing that 44% of true-positive alerts traced back to identity issues. The problem includes excessive permissions, misconfigured roles, and credential abuse that’s become incredibly cheap for attackers—legitimate cloud credentials are selling for as little as $2 on dark web markets. Here’s the shocking part: 99% of cloud identities are over-privileged, meaning attackers can simply log in as legitimate users without triggering alarms. Meanwhile, poor DevOps practices are causing systematic redeployment of legacy vulnerabilities, with 71% of critical vulnerability alerts coming from just four CVEs dating back to 2021. The average organization manages thousands of identities across AWS, Azure, Google Cloud and SaaS applications, creating a massive attack surface that’s growing faster than security teams can handle.
Sponsored content — provided for informational and promotional purposes.
The Two-Dollar Backdoor
Think about this for a second—your entire cloud infrastructure could be compromised for less than the cost of a coffee. The economics here are completely upside down. Attackers don’t need sophisticated zero-days when they can buy legitimate credentials that basically hand them the keys to the kingdom. And here’s the thing: these credentials aren’t being stolen through complex attacks. They’re ending up on dark web markets because companies are storing them insecurely, making them easy targets for phishing or infostealer malware.
But the real kicker? Even if attackers get in with basic credentials, they’re almost guaranteed to have excessive permissions. When ReliaQuest says 99% of cloud identities are over-privileged, they’re describing an industry-wide failure in identity and access management. Organizations have been so focused on enabling developers and speeding up deployment that they’ve basically given everyone keys to every room in the building.
DevOps Debt Comes Due
Now let’s talk about the other half of this problem—the systematic redeployment of legacy vulnerabilities. This is what happens when speed trumps security in DevOps pipelines. Companies are using templates and automation to spin up new infrastructure, but they’re baking old vulnerabilities right into every new deployment. It’s like photocopying a flawed blueprint thousands of times.
And the numbers don’t lie—71% of critical alerts coming from just four CVEs from 2021? That’s not a threat intelligence finding, that’s an indictment of how we’re handling vulnerability management. The cloud’s greatest strength—instant, automated scaling—has become its Achilles’ heel. New assets are being created faster than security teams can even scan them, let alone fix the problems.
What Actually Works
So what’s the solution? Well, ReliaQuest’s analysis points to some obvious starting points. First, companies need to get serious about least privilege access. I mean, 99% over-privileged? That’s not a minor configuration issue—that’s a fundamental design failure.
Second, organizations have to break the cycle of redeploying vulnerable templates. This means treating infrastructure-as-code security with the same seriousness as application security. Every automated deployment needs security checks built in, not bolted on afterward. Because by then? It’s already too late—the vulnerability has been replicated across your entire environment.
The scary part is that these aren’t new problems. We’ve been talking about identity management and vulnerability lifecycle for years. But the cloud scale has amplified the consequences to levels we’re only now beginning to understand. And honestly? The $2 price tag for cloud credentials should be a wake-up call that we’re making this way too easy for attackers.
