Is your cyber defense working at cloud speed?

In late October 2025, one of the world’s largest consulting firms – Ernst & Young (EY) – was revealed to have inadvertently exposed a massive 4-terabyte SQL Server backup on the public Internet, thanks to a misconfiguration during a cloud migration on Microsoft Azure.¹

The exposed backup contained not just benign metadata: it reportedly included API keys, session tokens, service-account credentials, internal database schemas, and possibly user credentials and client data. Because the file was publicly accessible, essentially “on the open web”, the risk was not theoretical; any scanning mechanism (malicious or benign) that crawled exposed storage buckets could have discovered it within seconds.

Though there is no public proof of a full-scale exploit (i.e., no confirmed mass data theft or ransomware triggered via this leak), the exposure alone is a serious breach of trust, data hygiene, and security best practices. For an organization of EY’s scale and resources, such an incident undermines its reputation and underlines a stark truth: even “secure-by-design” cloud migrations can go wrong.

This incident proves that with simple human error or misconfiguration, even a world-class security culture fails, turning a cloud “data lake” into a public dump. What happened at EY is more than a cautionary tale. It is a wake-up call for enterprises globally: in cloud environments, assumptions about inherent security are unsafe. Without continuous, automated visibility and guardrails, powerful platforms become liabilities, sometimes disastrously so. Momentary lapses can lead to full-blown cyber attacks.

The surge in cloud adoption in recent years has not only transformed digital infrastructure, but it has also dramatically expanded the threat surface. According to a 2025 report, the number of cyber attacks per week per organization has risen steeply. 

Organizations now face, on an average, 1,925 attacks per week – a 47% jump from 2024. Ransomware incidents saw a dramatic spike of 126% in Q1 2025 alone. Many of these incidents target cloud systems. In fact, around 80% of companies now report at least one cloud attack per year.²

Misconfigurations remain among the most common root causes: one survey indicates that around 23% of cloud-related incidents stem from misconfigurations, while human error underpins over half of all cloud breaches.³ Further, only a small fraction of organizations successfully encrypt the majority of their cloud data – a worrying trend, given that over 54% of data stored in the cloud is sensitive.⁴ 

Meanwhile, threats themselves are becoming more automated, scalable, and stealthy. Attackers now routinely employ stolen credentials, automated scanning, and even AI-enhanced techniques to probe cloud environments at scale. 

Cloud is the backbone of enterprise infrastructure. And with this shift, the volume, frequency, and sophistication of cloud-targeting attacks have also escalated. The cloud era demands more than legacy security; it requires new thinking, new tooling, and continuous guardrails.

That’s where platforms such as Cortex XSIAM come into play. XSIAM by Palo Alto Networks is built to address exactly the kinds of risks exemplified by the EY incident and rising cloud threats.

At its core, XSIAM provides continuous, automated monitoring and detection of misconfigurations, anomalous behavior, and potential security exposures across cloud environments, data lakes, application backends, storage buckets, identity and access systems, APIs, and more. 

It combines log aggregation, behavior analytics, identity-aware detection, and context-aware alerting to provide visibility into what’s happening – not just inside, but also what’s exposed to the public Internet.

Where traditional security tools often rely on manual audits or periodic scanning, XSIAM offers real-time, adversary-style exposure assessment. This means your security team doesn’t wait for a quarterly review to find a misconfigured backup: they get alerted immediately. With automated detection, response orchestration, and compliance reporting built in, XSIAM reduces mean time to detection (MTTD) and mean time to response (MTTR) substantially. Its exposure management capability cuts vulnerability noise by up to 99%, reducing the burden on the security teams.

Beyond detection, XSIAM can integrate with identity and access management (IAM), privilege management, encryption key stores, and cloud infrastructure orchestration tools. This enables automated remediation workflows, enforcing policy guardrails, and implementing zero-touch enforcement of security best practices.

Cortex XSIAM unifies essential SOC functions into one platform:

• Security information and event management (SIEM): Log management, correlation, alerting, reporting, and long-term data retention
• Threat intelligence platform (TIP): Aggregates and scores threat intelligence, including Unit 42® feed, enriching alerts and sharing data with third-party tools
• Extended detection and response (XDR): Collects telemetry from any source for broad detection coverage and top MITRE ATT&CK technique-level detections
• Endpoint protection platform (EPP): Blocks exploits, malware, and fileless attacks while providing full endpoint telemetry for response
• Attack surface management (ASM): Offers attacker’s view with asset discovery, vulnerability assessment, and risk management
• Identity threat detection and response (ITDR): Detects identity threats using machine learning and behavioral analysis to flag compromised accounts or insiders
• Security orchestration, automation, and response (SOAR): Automates workflows with hundreds of playbooks and a drag-and-drop editor for customization
• Cloud detection and response (CDR): Correlates cloud logs and other data for comprehensive detection and response across hybrid environments
• Management, reporting, and compliance: Centralized configuration, monitoring, reporting, and policy management

XSIAM offers the below advantages:

• Comprehensive visibility across multi-cloud and hybrid-cloud environments
• Proactive, not reactive security posture; catching misconfigurations or exposures long before attackers exploit them
• Contextual intelligence, correlating identity, network, storage, application, and user-behavior data to reduce alert fatigue and surface high-fidelity threats
• Automation and orchestration, accelerating response, isolating affected assets, and reducing human error
• Compliance and governance enforcement, ensuring that sensitive data remains protected, access is audited, and regulatory requirements are met

In a world where cloud complexity with containers, microservices, serverless computing, and shared storage grows daily, a platform like XSIAM is no longer optional. It becomes the backbone of a secure, resilient cloud architecture.
 

¹ EY Data Breach, 2025, SDX Central 

² Cloud Security Statistics, 2025, Sprinto

³ Cloud Security Statistics, 2025, SentinelOne

⁴ Key Cloud Statistics, 2025, Thales Group