Datadog’s 2026 Cloud Security Report Finds Persistent Credential and Permission Risks

Summary

Datadog’s 2026 study of thousands of organizations using AWS, Azure and Google Cloud finds persistent long-lived credentials and excessive permissions, alongside uneven adoption of cloud security guardrails.

Key points

The study primarily uses September 2026 data from Datadog customers. Among AWS IAM users with active access keys, 84% had a key older than one year; corresponding figures were 88% for Google Cloud service accounts and 50% for Entra ID applications with active credentials.
About 40% of sampled organizations used AWS data perimeters, primarily through resource-level policies. Organization-wide perimeter enforcement through SCPs and RCPs remained rare.
IMDSv2 enforcement reached 59% of EC2 instances, up from 47% a year earlier, but only 19% of instances more than two years old enforced it.
Public storage exposure declined to 1% of S3 buckets and 3.8% of Azure Blob Storage containers, while adoption of public-access blocking controls largely plateaued.
Datadog classified 17.7% of third-party AWS integrations as dangerously overprivileged; 7.78% of integration roles did not enforce an external ID.
Internet-exposed Kubernetes API servers remained common: 38% of EKS, 39% of AKS and 69% of GKE clusters. Risky node permissions affected 16% of EKS and 10% of GKE clusters.
Overly permissive access affected 18.9% of EC2 instances and 24% of Google Cloud VMs. Recommendations include temporary credentials, least-privilege roles and centrally enforced security defaults.

Article Details

Publisher: DataDog
Scope: Cloud security posture across AWS, Azure, and Google Cloud. Data was collected in September 2026, except AWS workload-permission data sourced in August and October 2026.
Sample Size: Thousands of organizations using Datadog Infrastructure Monitoring, Datadog Logs, or Datadog Cloud Security; exact count not disclosed.
Key Statistics: Among identities assessed for long-lived credentials, 84% of AWS IAM users had an active access key older than one year, 88% of Google Cloud service accounts had active keys older than one year, and 50% of Microsoft Entra ID applications had credentials older than one year.
Overall, 59% of EC2 instances enforced IMDSv2, compared with 47% a year earlier; only 19% of instances created more than two years earlier enforced it.
Among assessed third-party AWS integrations, 17.7% were dangerously overprivileged and 7.78% of integration roles did not enforce an external ID.
Managed Kubernetes API servers were internet-exposed in 38% of EKS clusters, 39% of AKS clusters, and 69% of GKE clusters.
The report classified 18.9% of EC2 instances and 24% of Google Cloud VMs as overprivileged. Azure VM permissions were excluded because the available combined data was insufficiently representative.
Recommendations: Replace long-lived credentials with temporary workload credentials and centralized, federated human authentication; remove unused credentials.
Enable IMDSv2 by default for new instances and enforce it through SCPs across environments.
Enable account-level S3 Block Public Access, protect its configuration with an SCP, and block public access in Azure storage accounts.
Use organization-level RCPs to enforce data perimeters rather than relying solely on resource-specific policies.
Remove unused third-party integration roles, grant minimum permissions, and keep workloads out of AWS Organizations management accounts.