AWS Route 53 Resolver is often misconfigured to allow unrestricted inbound and outbound query forwarding across VPCs and accounts. This creates attack paths for DNS-based data exfiltration, C2 tunnelling, and cross-account reconnaissance that bypass security group controls. Covers misconfiguration patterns, attack chains, CLI detection, and hardening.
Azure AI services — OpenAI, AI Search, AI Studio, and AI Foundry — introduce a new class of misconfiguration risk. This guide covers the most common exposure patterns, including key-based authentication, overly permissive RBAC, public endpoints, and the SSRF vector that earned a CVSS 9.9 in July 2026.
Azure Logic Apps is a common source of privilege escalation paths in Azure environments. Managed identities with excessive roles, insecure HTTP triggers with no authentication, and secrets embedded in workflow definitions create attack paths from workflow compromise to full subscription control.
Google Cloud Functions is one of the most common sources of cloud security misconfigurations: HTTP trigger functions deployed without authentication, overprivileged service accounts attached at the project level, and secrets exposed in environment variables. This guide covers each risk with gcloud CLI detection and remediation.
Unit 42 documented a technique where attackers register bucket names identical to those expected by multi-cloud pipelines but in a different cloud provider account, silently intercepting data streams without touching the victim's own cloud environment.
Google Cloud Secret Manager is the preferred secrets storage solution for GCP workloads, but IAM misconfigurations regularly expose secrets to over-privileged workload identities, compromised service accounts, and lateral movement paths. This guide covers the attack surface, documented exfiltration techniques, and hardening controls.
Google Cloud Build pipelines routinely leak secrets, run with overprivileged service accounts, and produce unsigned artifacts. This guide covers the five most common Cloud Build security failures — plaintext secrets, over-scoped service accounts, build log exfiltration, unsigned artifacts, and missing audit configuration — with gcloud remediation for each.
CloudTrail logs every API call against your AWS account — but knowing which events signal an active attack versus routine operations is the hard part. This guide covers the CloudTrail event patterns that matter most for detecting credential theft, privilege escalation, persistence, and lateral movement.
Azure Key Vault is the most common secrets store in Azure environments, and it sits at the centre of several high-impact attack paths. Misconfigured access policies, overprivileged managed identities, and legacy vault access models create routes from a compromised workload to full secrets exfiltration.