Key Takeaways
- Identity‑centric attacks dominate cloud breaches; a tiny fraction of non‑human identities control the majority of permissions.
- CI/CD pipelines act as privileged conduits that are often poorly governed, making them prime targets for supply‑chain compromise.
- Cloud‑native living‑off‑the‑land techniques exploit legitimate APIs and leave no malware, rendering traditional endpoint detection ineffective.
- Ransomware actors now prioritize destroying backup and recovery infrastructure to eliminate the option of restoration without payment.
- Effective programs refocus protection on the IAM management layer, CI/CD secret stores, backup interfaces, and root credentials, treating non‑human identity governance as an ongoing program.
- Detection must shift from compliance‑checklists to behavioral baselines that capture attacker workflows such as credential abuse, API‑based lateral movement, and pipeline manipulation.
The Evolving Cloud Threat Landscape in 2026
Organizations that have invested heavily in cloud security tools, established mature programs, and deployed extensive telemetry are still experiencing breaches. The failure is not due to inadequate controls but to a threat model that has outgrown the assumptions underlying those programs. Attack surfaces have expanded beyond what traditional security frameworks were designed to protect, creating structural gaps that adversaries exploit with relative ease. Recognizing this shift is the first step toward aligning defenses with the reality of how cloud environments are actually compromised today.
Identity and Credential Compromise: The New Crown Jewel
Identity has become the primary attack surface in cloud environments, serving not only as an entry point but also as the mechanism for lateral movement, privilege escalation, and persistence. Compromising a sufficiently privileged identity grants an attacker control‑plane authority, effectively allowing them to rewrite who can access what. Service accounts, API keys, OAuth tokens, CI/CD credentials, and workload identities now vastly outnumber human users—CyberArk estimates an average ratio of 82:1, rising to 144:1 in cloud‑native DevOps settings. AI agents add another layer: even when operating within legitimate permissions, they can be manipulated via prompt injection or tool misuse to perform actions that stricter governance would block. Veza’s 2026 State of Identity and Access Report reveals that just 0.01% of non‑human identities control 80% of all cloud permissions, underscoring how a small set of ungoverned machine accounts can wield disproportionate power.
CI/CD and Software Supply Chain Attacks: Privileged Pipelines Exploited
CI/CD systems concentrate non‑human identity risk because they routinely handle some of the most privileged credentials in an environment. Yet these pipelines are often ungoverned, unrotated, and invisible to both cloud and security teams. The tj‑actions/changed‑files incident of March 2025 illustrates the scale: over 23,000 repositories were potentially exposed during a 15‑to‑24‑hour window before the malicious commit was removed. Palo Alto Networks’ Unit 42 reports a 3.8× increase in SaaS supply‑chain attacks since 2022, now representing 23% of all attacks in 2025. The core problem is organizational: pipelines sit at the intersection of development and cloud infrastructure, owned by neither the cloud nor security teams, making it difficult to maintain a complete inventory of carried credentials, their storage locations, rotation schedules, or actual privilege levels. Without clear ownership, these pipelines remain a blind spot that attackers readily exploit.
Cloud‑Native Living‑Off‑the‑Land: Invisible Without Behavioral Baselines
Living‑off‑the‑land (LotL) techniques are not new, but their effectiveness in cloud‑native settings stems from visibility gaps rather than technique novelty. Endpoint Detection and Response (EDR) relies on agents installed on hosts, yet short‑lived containers, serverless functions, and managed services lack a persistent host for agent deployment. Consequently, EDR simply isn’t present where the activity occurs, not because it fails. Attackers weaponize native automation primitives—such as cloud CLI commands, infrastructure‑as‑code templates, or managed service APIs—using legitimate credentials, producing behavior indistinguishable from normal operations. The only traces appear in cloud audit logs, which often suffer from delivery delays, are deprioritized in cost‑cutting initiatives, and are sparsely covered by existing detection rules. Without behavioral baselines that differentiate benign from malicious API usage, these LotL attacks remain invisible.
Targeting Backup and Recovery Infrastructure: Denying Recovery
Ransomware has evolved from encrypting endpoints to systematically destroying an organization’s ability to recover. Sophos’ 2025 State of Ransomware in Enterprise found backup usage plummeting to a four‑year low of 53%, down from 73% the previous year. Veeam’s data shows that 96% of ransomware attacks specifically target backup repositories, with 76% of those attempts succeeding in compromising backups. Backup systems, disaster‑recovery infrastructure, and production workloads increasingly share the same cloud trust fabric—common IAM policies, network perimeters, and management planes. Once an attacker gains control‑plane access via compromised identities or pipeline abuse, they can reach backup repositories through the same identity and permission paths used to access production data, effectively eliminating the restoration option and increasing the likelihood of ransom payment.
What Effective Cloud Security Programs Are Doing Differently
To close the structural gaps, leading organizations are redefining what constitutes a “crown jewel.” Instead of focusing solely on data and applications, they prioritize the IAM management layer, CI/CD secret stores, backup management interfaces, and cloud provider root credentials—assets whose compromise grants near‑total control. They treat non‑human identity governance as a continuous program, explicitly including AI agents from inception, rather than a one‑time project. Detection strategies are shifting from compliance‑driven checklists to behavioral baselines that monitor attacker workflows: credential abuse, API‑based living‑off‑the‑land execution, CI/CD pipeline manipulation, and lateral movement via trust relationships. Investing in telemetry that captures cloud‑native activity—such as API call patterns, identity usage anomalies, and pipeline behavior—helps bridge the agent‑visibility gap. Finally, they architect recovery infrastructure outside the potential blast radius (e.g., isolated accounts, separate networking, or multi‑region backups) and budget for it explicitly, ensuring that even a successful control‑plane breach does not erase the ability to restore.
Conclusion: Aligning Security Programs with Real‑World Attack Flow
Cloud threats in 2026 defeat mature security programs not through exotic zero‑day exploits but through structural gaps—ungoverned pipelines, shared trust fabrics, missing visibility, and misaligned asset priorities. The question for security leaders is no longer “Is our cloud environment secure?” but “Does our security program reflect how cloud environments are actually attacked today?” By redirecting focus to the true crown jewels, instituting continuous non‑human identity governance, basing detection on observed attacker behaviors, and isolating recovery assets, organizations can transform their cloud security posture from a reactive compliance exercise into a resilient, proactive defense that matches the evolving threat landscape.