Tenable Research Finds Pervasive Cloud Misconfigurations Exposing Critical Data and Secrets

Rhea-AI Summary

Tenable's 2025 Cloud Security Risk Report reveals significant security vulnerabilities in cloud environments, with 9% of public cloud storage containing sensitive data, of which 97% is classified as restricted or confidential. The study found that 54% of organizations store secrets in AWS ECS task definitions, 52% in GCP Cloud Run, and 31% in Azure Logic Apps workflows. While the number of organizations with a "toxic cloud trilogy" decreased from 38% to 29%, significant risks persist. Even among the 83% of AWS organizations using Identity Provider services, security gaps remain due to overly-permissive settings and excessive entitlements. The research, conducted from October 2024 to March 2025, highlights the urgent need for improved cloud security practices and continuous risk management.

Positive

• Decrease in 'toxic cloud trilogy' vulnerabilities from 38% to 29% shows improvement in cloud workload security
• High adoption rate (83%) of Identity Provider services among AWS organizations indicates growing security awareness
• Comprehensive research covering multiple cloud platforms (AWS, GCP, Azure) provides valuable insights for security improvements

Negative

• 9% of publicly accessible cloud storage contains sensitive data, with 97% being restricted or confidential
• 54% of organizations store secrets in AWS ECS task definitions, creating direct attack paths
• 3.5% of AWS EC2 instances contain secrets in user data, posing major security risks
• Persistent security gaps in identity management due to overly-permissive defaults and excessive entitlements

Insights

Cybersecurity Analyst

Tenable's research demonstrates their leadership in cloud security by identifying significant risks organizations face from exposed data and misconfigurations.

Tenable's 2025 Cloud Security Risk Report reveals concerning statistics about cloud security vulnerabilities that highlight both market challenges and Tenable's expertise in identifying them. The finding that 9% of publicly accessible cloud storage contains sensitive data (with 97% classified as restricted or confidential) represents a significant attack surface for malicious actors. This research positions Tenable as a thought leader with unique visibility into cloud security trends.

The report's identification of specific risk vectors across major cloud platforms is particularly valuable. The data showing that 54% of organizations store secrets directly in AWS ECS task definitions, 52% in Google Cloud Platform's Cloud Run, and 31% in Azure Logic Apps workflows demonstrates Tenable's cross-platform expertise. Most concerning is that 3.5% of AWS EC2 instances contain secrets in user data, creating significant exposure given EC2's widespread use.

While the decrease in organizations with the "toxic cloud trilogy" from 38% to 29% shows modest industry improvement, it also indicates continued market need for Tenable's solutions. The research reinforces Tenable's value proposition in providing the visibility and remediation capabilities organizations need to address these persistent cloud security gaps. This report likely serves as both educational content and an effective marketing tool demonstrating Tenable's deep understanding of cloud security challenges.

Insecure cloud configurations create widespread risk, highlighting the urgent need for unified cloud exposure management

COLUMBIA, Md., June 18, 2025 (GLOBE NEWSWIRE) -- Tenable®, the exposure management company, today released its 2025 Cloud Security Risk Report. The research revealed that 9% of publicly accessible cloud storage contains sensitive data, 97% of which is classified as restricted or confidential. These exposures increase the risk of exploitation, particularly when paired with misconfigurations or embedded secrets.

Cloud environments face dramatically increased risk due to exposed sensitive data, misconfigurations, underlying vulnerabilities and poorly stored secrets – such as passwords, API keys and credentials. The 2025 Cloud Security Risk Report provides a deep dive into the most prominent cloud security issues impacting data, identity, workload and AI resources and offers practical mitigation strategies to help organizations proactively reduce risk and close critical gaps.

Key findings from the report include:

• Secrets found in diverse cloud resources are putting organizations at risk: Over half of organizations (54%) store at least one secret directly in Amazon Web Services (AWS) Elastic Container Service (ECS) task definitions — creating a direct attack path. Similar issues were found among organizations using Google Cloud Platform (GCP) Cloud Run (52%) and Microsoft Azure Logic Apps workflows (31%). Alarmingly, 3.5% of all AWS Elastic Compute Cloud (EC2) instances contain secrets in user data — major risk given how widely EC2 is used.
• Cloud workload security is improving, but toxic combinations persist: While the number of organizations with a “toxic cloud trilogy” – a workload that is publicly exposed, critically vulnerable, and highly privileged – has decreased from 38% to 29%, this dangerous combination still represents a significant and common risk.
• Using Identity Providers (IdPs) alone doesn’t eliminate risk: While 83% of AWS organizations are exercising best practices in using IdP services to manage their cloud identities, overly-permissive defaults, excessive entitlements, and standing permissions still expose them to identity-based threats.
  

“Despite the security incidents we have witnessed over the past few years, organizations continue to leave critical cloud assets, from sensitive data to secrets, exposed through avoidable misconfigurations,” said Ari Eitan, Director of Cloud Security Research, Tenable.

“The path for attackers is often simple: exploit public access, steal embedded secrets or abuse overprivileged identities. To close these gaps, security teams need full visibility across their environments and the ability to prioritize and automate remediation before threats escalate. The cloud demands continuous, proactive risk management, and not reactive patchwork.”

The report reflects findings by the Tenable Cloud Research team based on telemetry from workloads across diverse public cloud and enterprise environments, analyzed from October 2024 through March 2025. To download the report today, please visit: https://www.tenable.com/cyber-exposure/tenable-cloud-security-risk-report-2025

More information on Tenable Cloud Security is available at: https://www.tenable.com/cloud-security.

About Tenable
Tenable® is the exposure management company, exposing and closing the cybersecurity gaps that erode business value, reputation and trust. The company’s AI-powered exposure management platform radically unifies security visibility, insight and action across the attack surface, equipping modern organizations to protect against attacks from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. By protecting enterprises from security exposure, Tenable reduces business risk for more than 44,000 customers around the globe. Learn more at tenable.com.

Media Contact:
Tenable
tenablepr@tenable.com

FAQ

What are the key findings of Tenable's 2025 Cloud Security Risk Report?

The report found that 9% of public cloud storage contains sensitive data, 54% of organizations store secrets in AWS ECS task definitions, and while toxic cloud trilogy cases decreased to 29%, significant security risks persist across cloud environments.

What percentage of AWS organizations use Identity Provider services according to Tenable's report?

83% of AWS organizations use Identity Provider services to manage cloud identities, though security gaps remain due to overly-permissive settings and excessive entitlements.

What is the 'toxic cloud trilogy' mentioned in Tenable's report and how has it changed?

The 'toxic cloud trilogy' refers to workloads that are publicly exposed, critically vulnerable, and highly privileged. The percentage of organizations with this issue decreased from 38% to 29%.

How many AWS EC2 instances contain secrets in user data according to Tenable's research?

3.5% of all AWS Elastic Compute Cloud (EC2) instances contain secrets in user data, which represents a major security risk.

What are the main cloud platforms analyzed in Tenable's 2025 security report?

The report analyzed security issues across Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure cloud platforms.