{
  "id": 16237000,
  "title": "Hybrid Cloud Security: The Gaps Nobody Talks About Until It's Too Late",
  "url": "https://urgent.news/2026/10/23/hybrid-cloud-security-the-gaps-nobody-talks-about-until-its-too-late",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T22:16:41.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/alanconlon/hybrid-cloud-security-the-gaps-nobody-talks-about-until-its-too-late-4l64"
  },
  "original_language": "en",
  "account": "Many businesses do not transition their operations to cloud computing all at once. Instead, they adopt a hybrid approach, running some systems on-site and others in cloud services like Azure or AWS, while maintaining connections between the two. This hybrid state often hides the majority of security risks, yet these issues frequently go unnoticed. Over years of experience in managing hybrid environments, certain recurring gaps have emerged. None of them are groundbreaking or unusual; they are simply oversighted because everyone assumes someone else will manage them. The identity seam in a hybrid environment arises when on-premises Active Directory is linked to a cloud identity provider. This connection allows accounts and permissions to flow between the systems, meaning a breach in one environment can seamlessly extend to the other. A common mistake is treating these two directories as a single, trusted system. They are not. A service account with excessive permissions on-premises becomes significantly more dangerous once it gains access to the cloud tenant. Therefore, privileged accounts should be consistently evaluated end-to-end, not merely within the environment currently under review. Similarly, break-glass accounts should be confined to the cloud. Mapping out precisely what can move between the on-premises and cloud environments is crucial, and one must assume an attacker will exploit the most straightforward pathway. Typically, they do. Outdated permissions that are never revoked are another prevalent issue. Hybrid setups often accumulate permissions like a garage full of unused items. A temporary access request for a migration project is granted, but the access remains even after the project concludes. When applied across numerous years and hundreds of individuals, this scenario grows into an unmanageable sprawl that many organizations no longer fully comprehend. The solution is not glamorous; it involves regular reviews, automation where feasible, and a genuine commitment to removing unused access. The most challenging aspect is the cultural shift. People often resist having access revoked, even if they have never utilized it. However, every unused permission represents an open door. Effective logging is essential, yet many organizations simply check the \"logging enabled\" box and neglect further action. During incidents, they discover that the logs lack necessary details or are scattered across disparate systems that do not integrate seamlessly. Hybrid setups exacerbate this problem because visibility becomes fragmented. On-premises logs reside in one location, cloud logs in another, with the connection between them representing the critical point of clarity during an incident. Investing time upfront is worthwhile. Determine the information required if an incident occurs, then verify that this data is being captured. Validate this setup through testing before relying on it during an actual event. If these logs are directed to Sentinel, a few lines of KQL can swiftly verify their contents. Misunderstandings regarding shared responsibility are common. Cloud providers clearly delineate where their responsibilities end and yours begin. However, internally, teams frequently assume the provider handles more than it actually does. Statements like \"it's in the cloud, so it's covered\" have often preceded incidents. In a hybrid environment, this assumption becomes even more precarious, as responsibility varies depending on the component of the stack being examined. The remedy lies in explicit communication. Document the ownership of each system, ensuring those responsible are fully aware of their obligations. This approach is not about procuring additional tools. Contrary to popular belief, most hybrid security gaps can be mitigated by thoroughly understanding your environment, eliminating unnecessary elements, and clearly defining responsibilities, rather than by increasing the security budget. While tools can provide assistance, possessing a comprehensive and up-to-date understanding of your own estate holds greater value than any dashboard constructed atop confusion. Effectively managing hybrid environments relies more on the clarity of your knowledge about the estate than on the size of the security budget. Ultimately, the path to robust security in a hybrid world lies in paying attention to the interfaces between systems, the junctures where two environments converge and everyone assumes the other side has ensured their protection. In summary, hybrid security is primarily about maintaining vigilance at these connection points. This report, penned by Alan Conlon, emphasizes the importance of paying attention to these critical junctures in hybrid environments.",
  "summary": "Most organisations don’t move to the cloud in one clean jump. They end up with a foot in both worlds: some systems on-premises, some in Azure or AWS, and a lot of plumbing connecting the two. That in-between state is where most of the real security risk lives, and it rarely gets the attention it deserves. I’ve spent years working in and around hybrid environments, and the same gaps come up again…",
  "key_points": [
    "Hybrid cloud environments hide most security risks due to oversight.",
    "Identity seam connects on-premises AD with cloud identity provider, risking breach propagation.",
    "Regular reviews, automation, and clear responsibilities are key to mitigating hybrid security gaps."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}