Moving to the cloud does not hand your security to Amazon, Microsoft, or Google. They secure the building; you are still responsible for locking your own office inside it. This split is called the shared responsibility model, and misunderstanding it is behind most of the cloud breaches that make the news. Almost none are clever hacks — they are doors left open.
The one that causes the headlines: public storage
A storage bucket set to "public" is the classic cloud leak. Someone flips it open to share a file quickly, forgets, and months later a researcher — or an attacker — finds it indexed and full of customer data. Audit every storage container: it should be private unless there is a deliberate, documented reason it is not.
Over-generous permissions
It is quick to give an application or a staff member "admin on everything" and move on. It is also how a single compromised key becomes a full breach. Grant the least access that does the job, review it regularly, and never let a service account carry more power than the task in front of it needs.
Keys and secrets in the code
Access keys pasted into source code and pushed to a repository are scraped within minutes by bots that watch for exactly that. Secrets belong in a proper secrets manager, never in code, config files committed to git, or a shared spreadsheet.
No one watching
Cloud platforms can log everything that happens — but only if you turn logging on and someone actually looks. Enable audit logging from day one. It is close to free, and after an incident it is the difference between knowing exactly what happened and guessing.
Defaults are a starting point, not a finish line
Providers ship sensible defaults, but a default is built for the average case, not yours. Multi-factor authentication on the admin console, network rules that expose only what must be exposed, and encryption switched on for data at rest are all things you should confirm rather than assume.
A cloud configuration review is one of the fastest, highest-value assessments we run — a day or two that routinely turns up a wide-open bucket or an over-powered key the owner had no idea was there. If you have moved to the cloud in the last couple of years and never had a second pair of eyes on the setup, it is worth doing.