Wiz: Familiar Cloud Weaknesses Drove Most 2025 Intrusions as AI Expanded the Attack Surface
Summary
Wiz’s retrospective finds that familiar weaknesses drove about 80% of documented 2025 cloud intrusions. AI expanded where those risks could appear and helped accelerate existing attacker workflows.
Key points
- About 80% of documented cloud intrusions analyzed stemmed from known weaknesses, including vulnerabilities, exposed secrets, and misconfigurations.
- Shared infrastructure, trusted integrations, and widely used components allowed weaknesses to affect multiple organizations.
- AI services, pipelines, identities, and data paths expanded the cloud attack surface, often near sensitive data and high-value workloads.
- Wiz Research observed AI supporting and accelerating existing attacker activities, including reconnaissance, automation, and post-access activity.
- The report recommends visibility into exposure, identities, and how risk propagates across cloud, development, and AI systems.
Article Details
- Publisher
- Wiz Research
- Report Period
- 2025
- Scope
- Publicly documented cloud incidents, cloud telemetry, and hands-on investigations focused on cloud intrusions in 2025.
- Key Statistics
- Roughly 80% of documented cloud intrusions analyzed in 2025 began with known weaknesses, including vulnerabilities, exposed secrets, and misconfigurations.
- Recommendations
- Maintain visibility into exposure, identities, and how risk propagates across cloud, development, and AI systems to detect and disrupt attacker activity before it escalates.