Cloud Security Groundhog Day: Avoiding Recurring Mistakes in a Dynamic Landscape

Cloud Security Groundhog Day: Avoiding Recurring Mistakes in a Dynamic Landscape, published by SANS Institute in October 2025, examines why cloud security incidents keep repeating the same root causes despite years of cloud maturity. The paper covers five recurring problem areas, identity and access management, data security, network security, workload security, and detection and response, pairing each with the practical tools and approaches now available to fix it.

Key findings:

• More than 70% of cloud security incidents stem from customer misconfigurations or weak credential practices, not vulnerabilities in the cloud platforms themselves, according to Google's 2024 Threat Horizons report
• Machine identities (service accounts, IAM roles, API tokens, containers, serverless functions) often outnumber human users by orders of magnitude in cloud environments and are frequently created or deprecated without centralized oversight
• Major cloud providers like AWS, Azure, and Google Cloud offer thousands of individual permissions each, making over-permissioned roles common because broad access is easier to assign than finely tuned privileges
• Many enterprises still replicate on-premises Active Directory and static role-based access control patterns in the cloud rather than adopting granular, just-in-time, cloud-native access models
• Credential sprawl is pervasive: API keys, secrets, SSH keys, certificates, and access tokens are frequently stored in plaintext, reused across services, or never rotated across CI/CD pipelines and developer endpoints
• Cloud infrastructure entitlement management (CIEM) tools and native IAM privilege/role analysis (such as Google's IAM Recommender) are now mature enough to identify unnecessary permissions and enforce least privilege at scale
• Many organizations continue to deploy traditional virtual firewall appliances in the cloud as "a crutch," even though they become bottlenecks for east-west traffic in microservices architectures and rely on static rules that don't scale in ephemeral environments
• Organizations still relying heavily on virtual machines in the cloud often carry forward legacy security practices (and their mistakes), since VMs tend to be long-lived, over-permissioned, and inconsistently maintained compared to ephemeral workloads
• Many SOC teams in 2025 still look primarily at perimeter data, even though cloud telemetry is fundamentally different, consisting of API calls, configuration changes, and identity-based events rather than network-centric logs
• A significant skills gap in cloud detection and response stems from security teams being well-versed in traditional incident response but lacking experience with cloud service logs, ephemeral asset behavior, IAM misuse, and API-driven attacks
• In the age of AI, data governance is described as shifting toward "data as code," since training data ultimately determines what an LLM-powered chatbot or AI agent will do, making data governance failures carry over directly into AI risk
• Data security posture management (DSPM) and cloud-native application protection platforms (CNAPPs) are identified as the most significant recent improvements, automatically discovering and classifying sensitive data and closing visibility gaps that manual processes miss

The paper's throughline is that the "Groundhog Day" pattern in cloud security is largely self-inflicted: organizations keep porting on-premises architectures, tools, and assumptions (Active Directory-style IAM, virtual firewall appliances, EDR/NDR built for fixed networks) into a dynamic, API-driven, ephemeral cloud environment where those models don't hold up. The good news, repeated across each problem area, is that mature cloud-native tooling (CIEM, DSPM, CNAPP, policy-as-code) now exists to close these gaps; the remaining barrier is organizational adoption and skills, not a lack of available technology. The paper closes with a detailed checklist spanning identity and access management, data security, network security, workload security, and detection and response, intended to help security teams take concrete next steps in each area.