When people picture a cloud breach, they tend to imagine a skilled attacker cracking encryption or exploiting some obscure flaw. That’s rarely how it happens. An estimated 27 percent of organizations using public cloud infrastructure experienced a security incident in a recent 12-month period, and 82 percent of cloud misconfigurations trace back to human error rather than a software defect, according to research compiled by SentinelOne (SentinelOne, Cloud Security Statistics). The same research found the average cloud account carries 43 misconfigurations at any given time.
Put simply, most cloud data isn’t stolen through a broken lock. It walks out through a door someone left open, usually without realizing it.
The Shared Responsibility Gap
Part of the problem is a common misunderstanding about who is responsible for what. Microsoft, Google and Amazon secure the underlying infrastructure: the data centers, hardware and core platform. Customers are responsible for how they configure their own accounts, including who can access what, how files are shared, and which security features are turned on.
Many businesses assume that moving to Microsoft 365 or another cloud platform means security is handled. The platform gives you excellent tools, but many of them are optional, and the defaults are designed for convenience and collaboration rather than tight security. If nobody makes deliberate choices, the account ends up configured by accident.
What It Looks Like at Scale
Two widely cited incidents make the pattern concrete. Ticketmaster lost 40 million user records through a misconfigured cloud storage bucket that was accessible without proper authentication. Capital One’s 2019 breach exposed 106 million customer applications because of a misconfigured cloud firewall. Neither attacker needed to break anything. They just found a door that was supposed to be locked and wasn’t.
What It Looks Like at a Small Business
For a small or mid-sized business, the gaps are smaller in scale but just as real, and they tend to look like this:
- A file-sharing link set to “anyone with the link” instead of specific people, forwarded far beyond its original audience
- A SharePoint site or shared folder set up by a departed employee, with permissions nobody has reviewed since
- Guest accounts for outside vendors or contractors that were never removed after the project ended
- Legacy email protocols left enabled, allowing sign-ins that bypass multi-factor authentication entirely
- Mailbox forwarding rules quietly sending copies of messages to an outside address
- Admin accounts used for everyday work, so a single phished password grants full control
- Backup copies of sensitive data stored with looser access controls than the live system
None of these show up in a quick look at the admin dashboard. They show up when someone deliberately goes looking, or when an attacker does.
Why Configurations Drift
Cloud platforms give administrators enormous flexibility, and that flexibility is part of the problem. A setting that’s right for one team’s workflow can quietly expose data for another. Every new app, integration, employee or vendor adds a little complexity. Microsoft and Google also release new features constantly, some of which arrive turned on by default.
Over time, an environment that was configured carefully on day one drifts away from where it started. The same research found 69 percent of organizations struggle to keep security consistent across multiple cloud environments for exactly this reason. Nobody set anything up maliciously. Nobody is checking whether it’s still right six months later, either.
A Quick Self-Check
A few questions any business owner can ask their IT provider this week:
- How many files and folders are currently shared with “anyone with the link”?
- How many guest or external accounts exist in our tenant, and who are they?
- Are legacy sign-in methods that bypass MFA turned off?
- Do any mailboxes have forwarding rules to outside addresses?
- Who has global admin rights, and do they use separate accounts for daily work?
- When was our Microsoft Secure Score or equivalent last reviewed?
If the answers come back as “not sure,” that’s useful information in itself.
The Fix Is a Habit, Not a Product
Buying more cloud services won’t solve a configuration problem. What works is a standing practice of reviewing configuration and access on a schedule:
- Regular access reviews across every cloud platform in use, not just the ones that feel sensitive
- Default-deny sharing settings, with exceptions granted deliberately and set to expire
- Guest account cleanup on a fixed cycle
- Monitoring that flags configuration drift, such as new forwarding rules or sharing changes, not just active attacks
- A security baseline written down, so changes can be measured against something
Cloud Misconfiguration Questions
What is a cloud misconfiguration?
It’s a setting in a cloud service, such as sharing permissions or sign-in rules, that leaves data more exposed than intended. Most are caused by human error, not software flaws.
Is Microsoft responsible for securing my Microsoft 365 data?
Partly. Microsoft secures the platform itself, but each customer is responsible for configuring access, sharing and security settings in their own account.
How often should cloud settings be reviewed?
At least twice a year, with monitoring in between for changes like new forwarding rules, guest accounts or open sharing links.
The Takeaway
The cloud is generally more secure than the server closet it replaced, but only if someone is minding the settings. Most cloud exposure at small businesses comes from a handful of predictable gaps: open sharing links, stale guest accounts, legacy sign-ins and forgotten permissions. Each one is easy to fix once it’s found. The real risk is assuming the defaults are safe and never checking. Schedule a configuration review at least twice a year, and treat it as routine maintenance, the same as changing the oil.
Cloud9 Tech Solutions builds this review into our ongoing cloud services and security stack, so configuration gaps get caught on a schedule rather than after a client or a researcher finds them.
If nobody can tell you the last time your cloud sharing settings were reviewed, that’s worth finding out now. Schedule a free security assessment with Cloud9.