Cloud misconfigurations expose critical data and secrets, says Tenable
9% of publicly exposed cloud storage hold sensitive data, 97% classified as restricted or confidential
Dubai — Tenable, the exposure management company, released its 2025 Cloud Security Risk Report, which revealed that 9% of publicly accessible cloud storage contains sensitive data. Ninety-seven per cent of such data is restricted or confidential, creating easy and prime targets for threat actors.
Cloud environments face dramatically increased risk due to exposed sensitive data, misconfigurations, underlying vulnerabilities and poorly stored secrets – such as passwords, API keys and credentials. The 2025 Cloud Security Risk Report provides a deep dive into the most prominent cloud security issues impacting data, identity, workload and AI resources and offers practical mitigation strategies to help organizations proactively reduce risk and close critical gaps.
Key Findings From The Report Include:
● Secrets Found in Diverse Cloud Resources, Putting Organizations at Risk: Over half of organizations (54%) store at least one secret directly in Amazon Web Services (AWS) Elastic Container Service (ECS) task definitions — creating a direct attack path. Similar issues were found among organizations using Google Cloud Platform (GCP) Cloud Run (52%) and Microsoft Azure Logic Apps workflows (31%). Alarmingly, 3.5% of all AWS Elastic Compute Cloud (EC2) instances contain secrets in user data — major risk given how widely EC2 is used.
● Cloud Workload Security Is Improving, But Toxic Combinations Persist: While the number of organizations with a 'toxic cloud trilogy' – a workload that is a publicly exposed, critically vulnerable, and highly privileged – has decreased from 38% to 29%, this dangerous combination still represents a significant and common risk.
● Using Identity Providers (IdPs) Alone Doesn't Eliminate Risk: While 83% of AWS organizations are exercising best practices in using IdP services to manage their cloud identities, overly-permissive defaults, excessive entitlements, and standing permissions still expose them to identity-based threats.
'Despite the security incidents we have witnessed over the past few years, organizations continue to leave critical cloud assets, from sensitive data to secrets, exposed through avoidable misconfigurations,' said Ari Eitan, Director of Cloud Security Research, Tenable.
'The path for attackers is often simple: exploit public access, steal embedded secrets or abuse overprivileged identities. To close these gaps, security teams need full visibility across their environments and the ability to prioritize and automate remediation before threats escalate.
'The cloud demands continuous, proactive risk management, and not reactive patchwork.'
The report reflects findings by the Tenable Cloud Research team based on telemetry from workloads across diverse public cloud and enterprise environments, analyzed from October 2024 through March 2025.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Khaleej Times
an hour ago
- Khaleej Times
Dubai to host prestigious Sibos 2029 global banking conference
Dubai will host the Sibos 2029, the annual conference, exhibition and networking event organised by the Society for Worldwide Interbank Financial Telecommunication (SWIFT), according to UAE Banks Federation (UBF). Sibos conference and exhibition is one of the most important and largest events that connects thousands of executives, decision makers, technology providers, and thought leaders from across the industry to share experiences and views. SWIFT enables more than 11,000 financial institutions and corporations in more than 200 countries and territories to connect and exchange financial information securely and reliably, enhancing trade and financial transactions. The UAE was the first country in the Middle East and Africa to be selected by the global financial and banking sector to host Sibos in 2013. The UAE is the only country in the Middle East and Africa that has been ever chosen to host Sibos conference and exhibition since its establishment in 1978. This high-level event was held in several international financial centres such as Singapore, Geneva, Toronto, London, Amsterdam, and Beijing. The selection of the UAE to host Sibos 2029 reflects efforts made by UBF in cooperation with Dubai International Financial Centre, Dubai World Trade Centre, and Dubai Department of Economy and Tourism, and the support of the Central Bank of the UAE. 'The selection of Dubai to host Sibos 2029 is a testament to UAE's prominent position as a regional and global financial and banking centre," said Abdulaziz Al-Ghurair, chairman of UBF. "This selection also reflects international financial and banking industry's appreciation for UAE's efforts and innovative initiatives in developing and simplifying payments, adopting digital transformation to meet the needs of the banking and financial sector, and developing secure and efficient systems in line with the proactive policies of Central Bank of UAE, which places the security and efficiency of bank transfers as a top priority,' he added. Jamal Saleh, director-general of UBF and chairman of SWIFT User Group Steering Committee in the UAE, said Sibos 2029 is the most important international event in the field of payments, which is a fundamental pillar of socio-economic development. 'Central Bank of the UAE's initiatives in payments meet the requirements of various stakeholders and help achieve the objectives of the National Payment Systems Strategy, launched in 2019 to develop innovative payment solutions and enhance customer experience. It is enhancing the UAE's position in technological development, innovation, and security in the banking and financial sector,' he added. Marianne Demarchi, chief executive, Swift EMEA, said: 'Sibos brings the industry together on an unmatched scale, and we're delighted to be bringing the conference back to Dubai in 2029. The Emirate is a truly global financial hub in a geographically strategic location, and will be a fitting setting for the vibrant dialogue and debates that Sibos is famous for facilitating each year.'
Zawya
2 hours ago
- Zawya
Thawani Pay and Ominvest unveil ‘Ominvest Plus' for enhanced employee lifestyle benefits
Muscat: In alignment with its strategic vision to invest in the well-being of its human capital and foster meaningful private-sector partnerships, Thawani Pay has signed a strategic agreement with Oman International Development & Investment Company (Ominvest) to launch the "Ominvest Plus" initiative - an exclusive discount and offers platform tailored for Ominvest employees and their families. The agreement was signed by Majid Al Amri, Founder and CEO of Thawani Pay, and Abdulaziz Al Balushi, Group CEO of Ominvest, marking a significant step forward in employee-focused benefits under Thawani's 'Sama' corporate offers platform. The 'Ominvest Plus' platform unlocks a curated selection of offers across diverse lifestyle categories, including restaurants, hotels, wellness services, and automotive care. Designed to provide exceptional convenience, the card enables users to redeem unlimited offers through the Thawani app, with the flexibility to complete transactions via the app or through other preferred payment methods. The platform will be available exclusively to Ominvest employees and their families, ensuring a seamless and rewarding experience integrated into their everyday lives. In this context, Majid Al Amri, CEO of Thawani Pay said: 'At Thawani, our mission is to lead the fintech sector by delivering smart, simple, and secure payment services today's launch of the 'Ominvest Plus' exemplifies this commitment. By bringing exclusive lifestyle benefits directly to Ominvest employees and their families through our Sama platform, we're not only enhancing convenience but also redefining how fintech innovations can uplift human capital. This partnership underscores our belief that when technology, purpose, and care come together, we create ecosystems that drive real impact.' Commenting on the partnership, AbdulAziz Al Balushi, Group CEO of Ominvest said: 'At Ominvest, we continuously seek opportunities to create synergies across our diverse group companies and leverage cutting-edge technology to enhance value. 'Ominvest Plus' is a prime example of how we integrate innovation into our strategy to benefit our most valuable asset—our people. This collaboration with Thawani not only introduces tangible lifestyle benefits for our employees and their families but also reinforces our commitment to a tech-driven future and fostering a connected ecosystem within the Ominvest group. This collaboration with Thawani Pay aligns perfectly with our vision of building a future-ready enterprise.' Waleed Al Yarubi, Chief People, Corporate Communication and Sustainability Officer, added: 'This initiative is a testament to Ominvest's unwavering commitment to cultivating a thriving, people-first culture. This initiative is strategically aligned with our broader goals of sustainability and ESG, demonstrating our commitment to the well-being and growth of our human capital. By empowering our employees with smart, lifestyle-enhancing solutions, we are not only increasing engagement and retention but also building a more resilient and impactful organization from within.' This initiative underscores Thawani Pay's forward-looking approach to innovation and its role as a catalyst for transforming workplace experiences across the private sector. By aligning with institutions such as Ominvest, Thawani is helping shape dynamic and progressive work environments that prioritize employee well-being. Through thoughtful, tech-driven collaborations, the company continues to redefine how organizations can uplift their teams by offering smart benefits that are both practical and inspiring. As Thawani Pay continues to expand its corporate solutions and deepen its engagement with key stakeholders, it remains steadfast in its mission to build value-driven ecosystems where innovation and human impact go hand in hand. The launch of 'Ominvest Plus' stands as a testament to this vision by delivering meaningful benefits through collaboration, technology, and purpose.
Zawya
2 hours ago
- Zawya
Mobily recognized among the world's top 5 telecom operators
Mobily continues to drive strong value creation, positioning itself as a key player in the global telecom landscape. Deployment of AI positioned as an essential driver for operational excellence and competitive differentiation. BCG analysis serves as a guiding framework for telecom leaders aiming to navigate the complexities of an evolving digital ecosystem and capitalize on emerging opportunities for sustainable growth and industry leadership. Riyadh — Saudi Arabia's Mobily has entered the ranks of the world's top 5 telecom operator value creators, according to the Boston Consulting Group's (BCG) 2025 Telco Value Creators Report. The milestone is attributed to $7 billion in value creation from 2020 to 2024, representing a successful transformation driven by digital innovation and strategic positioning. The BCG report, titled "Returns May Be Declining, but Opportunity Is Calling," advocates for transformative growth in the telecommunications sector, despite prevailing industry challenges. According to the analysis, Mobily ranks 4th based on its five-year Total Shareholder Return (TSR) from 2020 to 2024, which stands at 19%. This achievement signifies a market capitalization of $11 billion. The competitive edge for six of the top ten telecom performers from emerging markets stems from regulatory conditions and investment approaches that successfully yield a Return on Invested Capital (ROIC) outpacing the Weighted Average Cost of Capital (WACC) by 60 basis points. Kaustubh Wagle, Managing Director & Partner, BCG said: "Developments in network structures and the introduction of innovative products, driven by the adoption of AI, have paved the way for significant value generation for telecommunications companies such as Mobily. These technological advancements harness AI's capabilities to significantly enhance the telecom sector, marking a pivotal moment for operators globally to re-evaluate their conventional approaches, considering the prospects that lie ahead towards the 2025 outlook. The research shows that by adopting progressive strategies, leading telecom firms illustrate a practical plan for substantial value growth, providing a model for others to follow in achieving success within the current market environment." The report underscores the critical necessity for telecom operators to enhance value generation through a multifaceted approach: optimizing physical and network assets, adopting new cost-efficient network architectures, and innovating with next-generation products and marketing strategies. How GCC Telcos Are Leading the Shift AI and digital services are emerging as pivotal elements in the transformation toward smarter, more efficient enterprises. Investments by operators in automation, customer intelligence, and tailored AI solutions for enterprises underscore this pivotal shift. This is further propelled by strategic alliances with both hyperscale cloud providers and local startups, driving scalable, bespoke enterprise AI solutions. In parallel, sovereign cloud and data security initiatives are important within the GCC region. Operators are forging partnerships with global technology corporations to establish compliant, local cloud infrastructures, reinforcing data residency and sovereignty—critical components for adherence to compliance standards and the monetization of AI and analytics in regulated industries. "For telecom companies, it's crucial to act quickly and with insight, utilizing AI as a key enhancer of innovation, operational effectiveness, and customer interaction. Mobily's success underscores the value of adopting a forward-thinking and innovation-led investment strategy, highlighting the significance of transformative mergers and acquisitions as well as the adoption of cutting-edge marketing strategies,' added David Panhans, Managing Director and Senior Partner at BCG The deployment of next-generation networks, such as 5G and Open RAN, are geared toward achieving operational efficiencies and incubating new revenue streams, including low-latency services integral to smart city and IoT frameworks. Efforts in edge computing and low-earth-orbit satellite partnerships aim to extend connectivity, granting telcos the opportunity to exploit untapped markets. Regarding monetization, the focus on enterprise modernization, the bundling of AI-driven services, and an infrastructure aligned with AI optimization are key components for maximizing the returns from investment in next-generation technologies. Further investments in next-gen network infrastructures align with the GCC's ambition to advance smart cities and assert digital leadership. The Path Forward: A New Model for Value Creation Telecommunications operators could benefit from a proactive approach to optimizing their strategic assets. This involves the monetization of infrastructural assets and the simplification of business models. By exploring shared-models and cloud-based solutions for non-core assets like fixed-line networks and data centers, telecommunications operators can enhance efficiency. Additionally, mergers and acquisitions are pivotal in solidifying market presence and achieving operational synergies, driving industry consolidation towards increased profitability and market leadership. Cost and Capital Expenditure (CapEx) optimization remains at the heart of this transformative agenda, with AI and automation serving as principal levers. AI enables significant CapEx efficiency through infrastructural innovations such as Open RAN, which mitigates vendor lock-in and lowers associated expenditures while additional network-sharing arrangements can generate substantial annual cost savings. As 5G deployments mature, redirecting cash flows from these efficiencies to facilitate growth or shareholder dividends underscores a disciplined CapEx strategy. The development of next-generation network architecture takes center stage, featuring cloud-native systems, Open RAN, and edge computing. These technologies are essential to reducing costs, fostering technological flexibility, and enabling advanced applications for smart cities and the Internet of Things. In concert with this architectural evolution, sales and marketing strategies are undergoing a transformative shift towards AI-empowered personalization, enhancing interactions across both B2C and B2B domains. The blend of automated and human-driven sales interactions represents a hybrid model where AI-addressable inquiries streamline customer service, reserving high-value interactions for expert human engagement. AI is playing a dual role, reducing operational costs and accelerating growth, enabling personalized consumer offerings and sector-specific B2B tools. The telcos poised for superior performance are those merging these strategies: modernizing network and operational infrastructure, refining asset portfolios to concentrate on areas with the highest potential, and innovating customer engagement through data-driven insights. As per BCG's report, embracing cloud-native technologies, facilitating edge computing for IoT applications, and executing on network-sharing agreements, have clear-cut implications for the evolution of the telecom sector's operational and competitive dynamics. About Boston Consulting Group Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we help clients with total transformation—inspiring complex change, enabling organizations to grow, building competitive advantage, and driving bottom-line impact. To succeed, organizations must blend digital and human capabilities. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives to spark change. BCG delivers solutions through leading-edge management consulting along with technology and design, corporate and digital ventures—and business purpose. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, generating results that allow our clients to thrive.
