Cloud Security in 2026: Attackers Don't Break In Anymore, They Log In
The 2026 threat data says something uncomfortable: most attackers aren't deploying malware, they're signing in with credentials that work, and they're doing it in the cloud. Here's what the numbers mean and what to actually change.
Usman Akram · · 6 min read
Here is a number worth reorganizing a roadmap around. Cloud-conscious intrusions by state-linked threat actors rose 266% in a year, according to CrowdStrike's 2026 Global Threat Report. Not 26%. Two hundred and sixty six.
And here is the number that explains how they are getting in: 82% of detections in 2025 were malware-free.
Put those together and the picture is blunt. The attacker going after your cloud is probably not deploying a virus for your tools to catch. They are logging in. With credentials that work.
Why "malware-free" is the whole story
Most security instincts were formed in an era where an attack meant a malicious file landed somewhere and something scanned it. That mental model is now the minority case. Four out of five detections involved no malware at all.
What replaces it is duller and much harder to see. The attacker gets a credential, from a phishing page, an info-stealer log bought on a forum, a token left in a repository, a helpdesk agent social-engineered into a password reset. Then they sign in and use the tools that are already there. The console. The CLI. The same admin utilities your platform team uses on a Tuesday.
There is nothing malicious to detect, because nothing malicious was installed. The activity looks like work. This is why a security posture built around "do we have endpoint scanning" answers a question the attacker stopped asking.
The signal that actually catches this is behavioral, and it is a question about identity rather than about files. Does this identity normally do this? From this location? At this hour? With this much data moving?
The cloud control plane is now the target, not the network
The 266% figure deserves a moment, because it says something specific. These are not attackers who happened to hit a server that lives in AWS. These are attackers who understand cloud and are going after it deliberately: the identity provider, the access keys, the roles and trust policies, the storage that got made public in a hurry two years ago and nobody revisited.
The old model put the crown jewels behind a network perimeter and spent the budget there. In a cloud environment, the control plane is the perimeter. An attacker with the right role assumption does not need to breach a network. They just have permissions.
| The old assumption | The 2026 reality |
|---|---|
| An attack means malware lands somewhere | 82% of detections had no malware at all |
| The network edge is the boundary | The identity and access layer is the boundary |
| We have days to notice and respond | Average breakout was 29 minutes, fastest was 27 seconds |
| AI is a productivity tool we adopt | AI is also a surface attackers exploit and a weapon they use |
Your detection budget is 29 minutes, and sometimes it is 27 seconds
Breakout time is the clock that starts when an attacker gets a foothold and stops when they move laterally into something else. It is, functionally, your window.
In 2025 the average eCrime breakout time fell to 29 minutes, a 65% jump in speed from the year before. The fastest recorded was 27 seconds.
Look at that against how most small and mid-sized companies actually operate. Alerts land in a channel nobody owns. Somebody reviews them in the morning. A real investigation waits for the one person who understands the environment to have a free afternoon. That cadence was survivable when attackers took days. Against 29 minutes it is theater.
You do not need a 24/7 security operations center to fix this, and most companies your size cannot justify one. What you need is for the small number of things that genuinely matter, a new admin role granted, a login from an impossible location, a mass data read, to page a human immediately instead of joining a queue. Ruthless prioritization beats comprehensive monitoring nobody reads.
The AI you deployed is now part of the attack surface
Two things are true at once, and the industry keeps discussing only the first.
Attackers are using AI to scale. CrowdStrike logged an 89% increase in attacks by AI-enabled adversaries. Faster reconnaissance, better phishing, more targets covered per operator.
But the second one is the part teams miss: over 90 organizations had their own legitimate AI tools exploited to generate malicious commands and steal sensitive data. The AI assistant with a database connection, the agent with a cloud role, the copilot wired into your internal systems. Those are credentialed, privileged, and typically unmonitored, which makes them an outstanding target.
If you have connected an AI agent to production and you cannot say exactly what it is permitted to do or produce a log of what it actually did, that agent is a cloud security problem wearing a productivity badge. We have written about governing agents before they become the breach and about shipping AI-built apps without the breach, and both apply here directly.
So what do you actually change?
The honest answer is that the fixes are unglamorous, which is exactly why they get skipped in favor of buying another dashboard.
- Fix identity first, because that is where the attacks are. Inventory every human and machine identity that can touch the control plane. Most teams find far more than they expected, and a startling number belong to people who left.
- Kill long-lived credentials. Static access keys sitting in a config file are the single most reusable thing an attacker can steal. Short-lived, scoped credentials turn a stolen key from a permanent backdoor into a nuisance.
- Enforce phishing-resistant MFA on anything with real permissions. SMS codes are better than nothing and worse than you think.
- Log the control plane and actually route the important events to a human. Not all of them. The handful that mean someone is doing something they should not.
- Scope your AI agents like you would scope a contractor. Least privilege, real audit logs, human approval on anything consequential.
- Prioritize by exploitability, not by alert volume. A thousand medium findings that are not reachable from the internet matter less than one over-permissioned role that is. Any tool that cannot tell you the difference is generating work, not reducing risk.
None of that requires an enterprise budget. It requires deciding that identity and access is a first-class engineering concern rather than something the platform team will tidy up after the next release.
The uncomfortable part
The attackers did not get more sophisticated in some cinematic way. They got more efficient. They stopped writing custom malware because they did not need to, and they went to the cloud because that is where the access is, and they started using AI because it makes one operator do the work of five.
The defense that answers that is not exotic either. It is disciplined identity, tight permissions, fast signal on the few events that matter, and treating your own AI tooling as a privileged user rather than a feature.
If you are running production infrastructure and are not confident you would notice a valid-looking login doing something it should not, that is the work our Cloud Infrastructure and Security and Compliance practices do, from identity and access reviews to hardening what you have already shipped. Tell us what you are running and book a discovery call, and we will give you a straight answer about where you actually stand.
All threat statistics in this post are from CrowdStrike's 2026 Global Threat Report, which analyzes 2025 threat data. Verified against the primary source on 12 July 2026.
Frequently asked
What does malware-free attack mean?
A malware-free attack is an intrusion where the attacker never drops a malicious file for your security tools to find. Instead they use valid credentials, legitimate admin tools, and built-in system utilities to do their work. CrowdStrike's 2026 Global Threat Report found 82% of detections in 2025 were malware-free. It matters because a defense built around scanning for bad files is looking for something that, most of the time, is not there. The signal you need is behavioral: this identity does not normally do this, from here, at this hour.
What is a cloud-conscious attacker?
A cloud-conscious attacker is one who understands cloud infrastructure specifically and targets it on purpose, going after the control plane, identity provider, access keys, and misconfigured storage rather than treating cloud servers like ordinary machines to infect. CrowdStrike recorded a 266% increase in cloud-conscious intrusions by state-linked threat actors. The practical implication is that your cloud identity and access configuration is now frontline security, not back-office hygiene.
What is breakout time and why does it matter?
Breakout time is how long it takes an attacker, after the initial foothold, to move laterally to another system in your environment. It is effectively your window to detect and contain them before the incident spreads. In 2025 the average eCrime breakout time dropped to 29 minutes and the fastest recorded was 27 seconds. If your team finds out about incidents from a daily report or a weekly review, the attacker has already finished moving.
How is AI changing cloud attacks?
In two directions at once. Attackers are using AI to scale their operations, with CrowdStrike recording an 89% increase in attacks by AI-enabled adversaries. And the AI tools you deploy become targets themselves: over 90 organizations had legitimate AI tooling exploited to generate malicious commands and exfiltrate data. So AI is both a force multiplier for the attacker and a new surface for them to attack, which means securing your AI tooling is now part of securing your cloud.
Where should a small team start with cloud security?
Start with identity, because that is where the attacks actually are. Get every human and machine identity inventoried, kill long-lived static access keys in favor of short-lived credentials, enforce phishing-resistant multi-factor authentication on anything that can touch the control plane, and turn on logging for the control plane itself so a suspicious login leaves a trail. That work is unglamorous and it addresses the majority of real intrusions. Buying another scanning tool before you have done it is spending money on the wrong problem.
CTO, IrenicTech
Usman is the CTO of IrenicTech. He builds AI agents, RAG systems, and automations into web and mobile products, and gets them shipped in weeks instead of quarters. He's focused on AI that learns from the people using it, and that's secure enough to trust with real data.
Connect on LinkedIn
