Addressing the CSA Top Threats to Cloud Computing 2026

In August 2026, the CSA published a report titled "Addressing the Top Threats to Cloud Computing 2026," which was analyzed by a team of 507 experts. The report identified 11 issues, each with a severity score ranging from 7.45 to 7.95, indicating that all eleven were considered equally severe by the industry. For the first time, two AI-specific threats were included: AI-Enhanced Attacks at rank 2 and AI System Compromise at rank 6.

The report aimed to highlight what organizations should be concerned about, but it did not provide guidance on how to check these worries mechanically. The team took this report and asked a different question: what machine-verifiable properties can be extracted from a cloud configuration snapshot, and have they already been checked?

The analysis revealed 112 properties across all 11 issues, with 93 of those properties being snapshot-verifiable. This means they could be checked by examining current AWS configuration data, such as IAM policies, security group rules, encryption settings, logging configuration, and resource tags. Of the 93 snapshot-verifiable properties, 77 were fully covered, 14 were partially covered, and 2 were pending on observation data.

The remaining 19 properties were out of scope because they required runtime behavior, organizational processes, or data that didn't exist in a configuration snapshot. These properties were categorized as runtime-behavioral or procedural. Runtime-behavioral properties require observing system behavior over time, such as API call patterns, anomalous logins, data access frequency, and runtime attestation.

Procedural properties involve organizational processes, like access reviews, incident response plans, and shared responsibility understanding, but these are not machine-checkable.

The team found that 91 out of 93 snapshot-verifiable properties were at least partially covered, resulting in a 97.8% coverage rate. This means that for every configuration property that can be verified from an AWS snapshot, there is at least partial coverage. However, there are still 14 partial items that are narrow scope boundaries within well-covered areas, such as container base image currency, which is already checked through ECR scanning, image signing, digest pinning, and untrusted registry pulls.

In summary, 97.8% of the properties can be verified from a cloud configuration snapshot, with 14 partial items that don't pose a significant gap. The remaining 19 out-of-scope properties require runtime behavior, organizational processes, or data that is not available in a configuration snapshot.