July 18, 2026 · Alastor InfoSec Team
Cloud VAPT in 2026: Why Cloud Vulnerabilities Grew 44x But Cloud Testing Barely Moved
The numbers are stark. Cloud vulnerabilities grew 44 times in 2025. Cloud testing coverage grew 1.23 times. Cloud overtook web applications as the primary attack surface in three separate quarters last year, and it now accounts for 39% of total vulnerability volume across enterprise environments. Yet cloud workloads receive only 14% of pentest engagement time.
That gap — between the scale of cloud risk and the scale of cloud testing — is one of the defining security failures of 2026. For Indian organisations building on AWS, Azure, and GCP while simultaneously facing DPDPA enforcement and CERT-In audit requirements, closing it is not optional.
Why Cloud Security Testing Has Lagged
The lag is partly technical and partly cultural. Legacy penetration testing methodologies were built around network-connected systems with fixed IP addresses, operating systems that could be scanned, and application servers that responded to known probe techniques. Cloud environments break all of those assumptions.
An AWS account is not a server — it is a collection of IAM policies, S3 bucket ACLs, Lambda functions, VPC configurations, CloudTrail settings, and API Gateway rules, none of which traditional port scanners touch. A penetration tester who approaches cloud infrastructure with a Nessus scan and a web app assessment is covering, at best, a small fraction of the actual attack surface.
The cultural lag compounds the technical one. Many security teams still assign cloud security testing to the same engagement scope as web application testing, without carving out dedicated cloud-specific assessment time. The cloud environment ends up as an afterthought — checked for a few obvious misconfigurations and then considered covered.
Meanwhile, 95% of cloud security failures still stem from misconfigurations — not platform-level vulnerabilities in AWS or Azure themselves, but mistakes made in how organisations configure and use those platforms. These misconfigurations are not detectable through traditional VAPT techniques. They require cloud-native assessment tools, knowledge of specific service defaults, and an understanding of how permissions chain across services.
The Indian Context
India's position makes this urgency acute. India is the second most targeted country globally for cyberattacks, with more than 265 million malware detections recorded in 2025–2026. Indian organisations are adopting cloud infrastructure rapidly, driven by digital-first business models and government cloud mandates, but security investment has not kept pace with adoption velocity.
Around 40% of Indian cybersecurity teams are understaffed and lack critical skills in cloud security specifically. This is not unique to India, but it is particularly acute given the growth rate of cloud adoption in Indian enterprises. Many organisations have moved production workloads to the cloud without conducting a single cloud-specific security assessment.
DPDPA adds a regulatory dimension. Under the Digital Personal Data Protection Act, data fiduciaries are responsible for the security of personal data they process — regardless of whether that data sits on-premises or in a cloud environment. An S3 bucket misconfiguration that exposes customer records is a DPDPA breach. The compliance exposure from cloud misconfigurations is no longer hypothetical.
SEBI's CSCRF and CERT-In's audit requirements for regulated entities similarly make no distinction between on-premises and cloud infrastructure. Both are in scope.
What Cloud VAPT Actually Covers
A proper cloud security assessment in 2026 covers substantially more than traditional VAPT. The assessment should span:
Identity and Access Management (IAM) review — mapping all IAM users, roles, and policies to identify excessive permissions, privilege escalation paths, cross-account trust relationships, and stale credentials. In our experience, the majority of serious cloud security findings originate in IAM, not in exposed ports or vulnerable software.
Storage and data exposure assessment — reviewing S3 buckets, Azure Blob containers, and GCP Cloud Storage for public access settings, bucket policies, ACLs, and logging configurations. This includes checking for pre-signed URL abuse and checking whether logging is enabled to detect unauthorised access.
Network configuration review — assessing VPC configurations, security group rules, network ACLs, and peering connections for overly permissive rules, unintended exposure of management interfaces, and inadequate segmentation between environment tiers.
Compute and serverless security — reviewing EC2 instance metadata service (IMDS) configurations for IMDSv2 enforcement, checking Lambda execution roles for excessive permissions, and assessing container deployments for known image vulnerabilities and misconfigured registries.
Logging and monitoring coverage — verifying that CloudTrail, CloudWatch, Azure Monitor, or equivalent services are configured to capture the events needed for incident detection and forensic investigation. Many environments have logging nominally enabled but misconfigured to exclude the event types that matter most.
CI/CD pipeline and secrets assessment — checking GitHub Actions, GitLab CI, or other pipeline configurations for hardcoded credentials, overly permissive deployment roles, and insufficient branch protection rules.
Third-party SaaS integration security — reviewing OAuth grants, API token permissions, and data-sharing configurations for SaaS tools connected to the cloud environment.
Continuous Assessment Versus Point-in-Time Testing
The 44x growth in cloud vulnerabilities tells us something important: the cloud attack surface is not static. New services are deployed, configurations drift, new IAM policies are created, and new integrations are added — often without security review. A once-a-year cloud assessment gives you a snapshot of your exposure on the day the assessment was conducted. Twelve months later, the assessment may be largely irrelevant.
This is the core argument for continuous cloud security assessment. Alastor Pulse, our PTaaS dashboard, continuously monitors your cloud environment for configuration drift, newly exposed resources, and emerging vulnerability patterns — not just during scheduled engagement windows. When a new S3 bucket is created with public access enabled, the platform flags it within hours. When an IAM policy is modified to grant new permissions, the change is reviewed against your baseline.
Enforster AI layers AI-powered scanning across your cloud environment's GitHub repositories and deployment pipelines, surfacing leaked credentials, misconfigured secrets, and insecure infrastructure-as-code before they reach production.
Building a Cloud Security Programme
For organisations that are starting from a limited cloud security baseline, the practical starting point is a comprehensive cloud security posture assessment — a structured review of your cloud account configurations against a recognised benchmark such as the CIS AWS Foundations Benchmark, CIS Azure Benchmark, or CIS Google Cloud Platform Benchmark. This gives you a baseline and a prioritised remediation list.
After remediating critical and high-priority findings, the next step is to establish ongoing monitoring that can detect configuration drift. Native tools like AWS Security Hub, Azure Defender, and GCP Security Command Center provide a foundation, but they require configuration and tuning that many organisations never complete.
The most mature cloud security programmes combine continuous automated monitoring with periodic human-led assessments that cover the aspects automated tools miss — complex IAM privilege escalation paths, business logic vulnerabilities in cloud-native applications, and the interaction effects between services.
The Cost of Not Testing
Cloud breaches are among the most expensive incidents organisations face. Misconfigured storage buckets have exposed hundreds of millions of records. Overly permissive IAM roles have given attackers full account takeover. In the Indian regulatory context, these incidents now carry DPDPA notification obligations and potential penalties alongside reputational damage and remediation costs.
The cost of a comprehensive cloud security assessment — delivered through a PTaaS model — is a fraction of the cost of a single cloud breach. For organisations deploying customer data in cloud environments under DPDPA obligations, it is also an increasingly non-negotiable compliance requirement.
Reach out to us at [email protected] or visit Alastor Pulse to discuss how continuous cloud VAPT can close the gap between your cloud exposure and your testing coverage.
Cloud vulnerabilities grew 44x in 2025 while cloud testing grew just 1.23x — closing that gap requires cloud-native assessment methodology, not traditional VAPT applied to a new environment.