Introduction
Every October, Cybersecurity Awareness Month encourages organizations to revisit the fundamentals: spot the phishing email, enforce MFA, and keep systems patched. While those measures remain essential hygiene, modern cloud incidents tell a sobering story: mature enterprises with well-funded security programs and fully deployed tooling are still experiencing breaches. The breakdown isn’t caused by broken controls; it happens because the threat landscape has outgrown the traditional threat model. Rather than dropping external malware or tripping perimeter alarms, attackers increasingly log in through legitimate credentials, navigate authorized channels, and operate using valid identities.
In this opening installment of the three-part series, What Cloud Incidents Are Actually Telling Us, we examine what real-world cloud intrusions look like in 2026, dissect the data behind modern initial access vectors, and explore why identity has become the control plane attackers are actively rewriting.
The Operational Reality of Cloud Security
In one in three of the intrusions Mandiant investigated in 2024 (M-Trends 2025), investigators could not determine how the attackers gained initial access. While several factors can contribute to that uncertainty, Mandiant notes that it also points to potential deficiencies in enterprise logging and detection capabilities.
That is the operational reality of cloud security in 2026: organizations with mature programs, real investment, and deployed tooling are still getting breached. Not because their controls are wrong, but because part of the threat model has shifted in ways those controls were never designed to address. This isn’t about teams falling behind. Instead, it’s about an attack surface that has outgrown the assumptions most programs were built on, and that deserves more attention than it’s currently getting.
The Four Pillars of the Modern Cloud Threat Landscape
Identity sits at the center of that shift. Cloud infrastructure is, at its core, an identity problem: access to every resource, compute, storage, secrets, management planes, is mediated by an identity and a set of permissions. That’s true whether the identity belongs to a person, a workload, a CI/CD pipeline, or, increasingly, an AI agent. This series looks at what modern cloud threats actually look like today, organized around four categories that dominate the current incident landscape:
- Identity and credential compromise — including human users, machine workloads, and AI agents — at a scale most programs have never governed
- CI/CD and software supply chain attacks targeting the pipelines that carry the most privileged credentials in the environment
- Cloud-native living-off-the-land techniques that leave no malware behind and are invisible without behavioral baselines
- The deliberate targeting of backup and recovery infrastructure to deny organizations the ability to recover without paying.
For each threat type, this series will cover what the attack looks like in practice, why it keeps succeeding despite existing controls, and what effective programs are doing differently. Finally, we will look at the structural and organizational reasons these gaps persist, and the specific changes that close them.
Why the Legacy Threat Model No Longer Works
Before we dive into the threats, we need to understand why the legacy model for intelligence and defense is out of date. The threat model most organizations still operate with imagines an attacker who introduces something external and detectable into the environment: a malicious payload, an unusual process, an anomalous network connection that does not match the baseline. The controls built around that model are optimized to detect the presence of something that should not be there.
The dominant cloud threat pattern in 2026 inverts that model. Attackers increasingly arrive through authorized channels, use legitimate tools, operate under valid identities, and generate activity that is in isolation indistinguishable from normal operations.
What the 2026 Incident Data Actually Reveals
The numbers are consistent across independent data sources, though it’s worth being precise about which numbers come from where.
Google Cloud’s H1 2026 Cloud Threat Horizons Report, drawing on Mandiant Incident Response and Threat Defense engagements from H2 2025 found that identity compromise underpinned 83% of incidents involving major cloud and SaaS-hosted environments, while high-volume data theft through legitimate access channels remained the primary attacker objective in 73% of cloud-related incidents. Looking specifically at observed incidents within Google Cloud customer environments during H2 2025, third-party software-based entry (44.5%) overtook weak or absent credentials (27.2%) as the primary initial access vector for the first time. Google notes that these attacks primarily exploited known CVEs, suggesting that threat actors are increasingly opting for faster, more automated paths of software-based entry.
Unit 42’s 2026 Global Incident Response Report, drawing on more than 750 incidents, found that identity weaknesses played a material role in almost 90% of all investigations and that 65% of initial access was driven by identity-based techniques.
Verizon’s 2025 DBIR confirmed credential abuse as the leading root cause for the second consecutive year.
These findings are not contradictory; they describe different dimensions of the same threat landscape. The broader 83% and 73% figures highlight the central role identity compromise and legitimate access played across cloud and SaaS compromises, while the 44.5% and 27.2% figures focus specifically on the initial access techniques observed within Google Cloud customer environments during H2 2025.
Taken together, these findings suggest that attackers will continue to use whichever entry path offers the least resistance — credential abuse where identity controls remain weak, and software-based entry where stronger identity defenses force them toward application-layer exploitation. Rather than describing competing trends, the two findings illustrate different facets of the same evolution in cloud attacks.
Digging Deeper into Trends
Now that we understand how the legacy threat model has been inverted, the next part of this series will dive into the four principal cloud threat types in much greater detail. We will break down exactly how these modern attacks unfold, why they successfully bypass existing controls, and what the most resilient security programs are doing differently to stop them.
In the meantime, you can explore some of the the data driving these shifts by downloading our latest research:
- CyberProof 2026 Mid-Year Cyber Threat Landscape Report:
Uncover the major developments from the first half of 2026. This mid-year update details how attackers are shifting focus away from traditional endpoints to directly target trusted enterprise technologies, software supply chains, and emerging AI infrastructure.
- CyberProof 2026 Global Threat Intelligence Report:
Explore the comprehensive analysis of the tactics defining the modern landscape, including the systematic weaponization of identity and the industrialization of AI-driven attacks. This report unpacks how threat groups are collaborating in blended ecosystems and increasingly exploiting interconnected SaaS platforms to reach multiple downstream targets.
