cyber.hendryadrian.com
Interesting Stuff · wiz.io

Twenty Years of Cloud Security Research: From Cloud Foundations to AI

· Original article ↗

Summary

A retrospective traces cloud security from early AWS foundations through the CSPM and CNAPP eras, then examines how AI is accelerating both vulnerability exploitation and defensive work.

Key points

  • The article marks the cloud’s 20-year anniversary from AWS S3’s 2006 launch and notes that public-bucket misconfiguration was possible from the start.
  • Early cloud security lacked modern basics such as IAM and CloudTrail; AWS Organizations and Service Control Policies arrived in 2016.
  • As cloud adoption and complexity grew, the 2016–2021 CSPM era brought dedicated security roles, open-source tools, benchmarks, and community groups.
  • From 2021, CNAPP platforms grew beyond standalone posture-management tools as cloud environments became more complex and teams faced incidents such as Log4Shell.
  • The article describes cross-tenant cloud vulnerabilities and vendor research teams as notable features of the CNAPP era.
  • It argues that AI is accelerating vulnerability analysis and exploit development, citing CVE-2025-32433 and a proof-of-concept for mongobleed reportedly created in 10 minutes.
  • AI is also helping defenders write more secure code, patch faster, and use security tools; the author says AI adoption is outpacing the development of security foundations.

Article Details

Topic
The evolution of cloud security research and tooling across the foundational, CSPM, CNAPP, and AI eras, including AI’s growing role in vulnerability discovery and exploit development.

CVE

CVE-2025-32433and create exploits for them at a much faster rate than ever before.  An early example of this was CVE-2025-32433 in April 2025, which was a vulnerability that would normally require a deep understanding of the

People

Andres RianchoPresented “Pivoting in Amazon Clouds” in 2014.Daniel GrzelakPresented “Hacking AWS end-to-end” in 2016.Erik PetersonPresented “Bringing a Machete to the Amazon” in 2014.Haroon MeerCo-presented “Clobbering the Cloud” in 2009.Jack NaglieriHighlighted for work on serverless log analysis and unit tests for detection rules at Airbnb.Kapil ThangaveluHighlighted for work on auto-remediation at Capital One.Marco SlavieroCo-presented “Clobbering the Cloud” in 2009.Nick ArvanitisCo-presented “Clobbering the Cloud” in 2009.Ryan DeivertHighlighted for work on serverless log analysis and unit tests for detection rules at Airbnb.Ryan HuberHighlighted for work on distributed security alerting at Slack.

Vendors

WizThis era was kicked off by a storm of cross-tenant vulnerabilities exposed on the cloud providers, such as Wiz’s chaosdb, omigod, and more from them and other companies which can be found in cloudvulndb. 

Products

AWSOn March 14, 2006, AWS announced S3, marking the first AWS service that was generally available and what AWS celebrates as their start.  Azure and GCP can each be traced back to slightly later dates, so March 14, 2026AWS IAMfeatures that are core to any concepts of security, such as least privilege and logging.  For example, AWS IAM wasn’t released until 2011, so the first five years of using AWS meant having a shared root account withAWS OrganizationsAWS Organizations was released in 2016 which normalized the idea of having multiple AWS accounts.  For a long time companies ran entirely inside a single AWS account.  The release of Organizations also came with ServiceAzureS3, marking the first AWS service that was generally available and what AWS celebrates as their start.  Azure and GCP can each be traced back to slightly later dates, so March 14, 2026 is therefore the 20 yearCIS Benchmark for AWSof open-source tools from individuals and teams that were dedicated to cloud security.  The CIS Benchmark for AWS was released in 2016 which standardized detections that many of these tools would look for. CloudCloudTrailadmin privileges for all your employees and applications which would use root access keys.  Similarly, CloudTrail wasn’t released until 2013, so you had no audit record until then.  Prior to this, if you realized youCNAPP2021-2025: The CNAPP eraGCPthe first AWS service that was generally available and what AWS celebrates as their start.  Azure and GCP can each be traced back to slightly later dates, so March 14, 2026 is therefore the 20 year anniversary ofHackerOneexploit for the mongobleed vulnerability in 10 minutes. 2025 also saw an AI product become the top HackerOne bug bounty winner, and another AI product team won Wiz's zeroday.cloud competition where bounties wereLog4shellcomplex and splitting into further sub-specializations as AWS crossed 10,000 APIs in late 2021.  Log4shell at the end of 2021 was a defining moment for many cloud security teams as they recognized they neededService Control Policiescompanies ran entirely inside a single AWS account.  The release of Organizations also came with Service Control Policies which provided an organization level capability for company-wide control. By this point I

Tools

Cloud CustodianMonkey in 2014.  Notable tools during this era (and companies the developers worked at) included Cloud Custodian (CapitalOne), Pacu (Rhino Security), Prowler (Alfresco), CloudMapper (Duo Security), Cloud InquisitorCloud InquisitorCloud Custodian (CapitalOne), Pacu (Rhino Security), Prowler (Alfresco), CloudMapper (Duo Security), Cloud Inquisitor (Riot Games), StreamAlert (Airbnb), RepoKid (Netflix), gcp-audit (Spotify), margaritashotgunCloudMapperworked at) included Cloud Custodian (CapitalOne), Pacu (Rhino Security), Prowler (Alfresco), CloudMapper (Duo Security), Cloud Inquisitor (Riot Games), StreamAlert (Airbnb), RepoKid (Netflix), gcp-auditPacutools during this era (and companies the developers worked at) included Cloud Custodian (CapitalOne), Pacu (Rhino Security), Prowler (Alfresco), CloudMapper (Duo Security), Cloud Inquisitor (Riot Games),Prowler(and companies the developers worked at) included Cloud Custodian (CapitalOne), Pacu (Rhino Security), Prowler (Alfresco), CloudMapper (Duo Security), Cloud Inquisitor (Riot Games), StreamAlert (Airbnb), RepoKidRepoKidProwler (Alfresco), CloudMapper (Duo Security), Cloud Inquisitor (Riot Games), StreamAlert (Airbnb), RepoKid (Netflix), gcp-audit (Spotify), margaritashotgun (Mozilla), cloudsploit (Adobe),  and many more. Many ofscoutTwo early forerunners to this era of tool releases were iSecPartner’s scout tool in 2011 (which would later become NCC Group’s Scout2 in 2014) and Netflix’s Security Monkey in 2014.  Notable tools during this era (andScout2to this era of tool releases were iSecPartner’s scout tool in 2011 (which would later become NCC Group’s Scout2 in 2014) and Netflix’s Security Monkey in 2014.  Notable tools during this era (and companies theSecurity MonkeyiSecPartner’s scout tool in 2011 (which would later become NCC Group’s Scout2 in 2014) and Netflix’s Security Monkey in 2014.  Notable tools during this era (and companies the developers worked at) included CloudStreamAlertPacu (Rhino Security), Prowler (Alfresco), CloudMapper (Duo Security), Cloud Inquisitor (Riot Games), StreamAlert (Airbnb), RepoKid (Netflix), gcp-audit (Spotify), margaritashotgun (Mozilla), cloudsploit (Adobe),  and

Related Articles