Cloud security is not measured by what you have deployed. It is measured at 2am
Governance tells you who owns the risk, but only detection discipline tells you whether anyone is watching it, says Hendrik Kruger, CTO and CISO at Cloud On Demand.
Many organisations claim to have robust cloud security, citing certifications and endpoint detection tools. Yet, genuine detection capability often falls short. Security measures may be unenabled, improperly configured, or left without the necessary staff to respond. The biggest risk lies in identity-related intrusions, often through phishing, credential reuse, or purchased credentials.
These threats typically manifest as risky sign-ins, anomalous consent grants, or suspicious inbox rules. Alerts are generated, but crucial actions are delayed until the next workday, sometimes even until an on-call engineer responds. A composite scenario shows how a phishing attack, followed by misconfigured security measures, leads to unauthorized access, despite all alerts being captured and none acted upon until 9:20am the following Monday.
The key lies in having a detection discipline in place, with clearly defined roles, procedures, and regular rehearsals to respond promptly to detected threats. This proactive approach prevents the costly consequences of false positives and ensures a swift response to genuine security incidents.
Written by urgent.news from ITWeb's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
