Cloud Security
Cloud Security on Beyond Market Intelligence: a running collection of 8 stories we have gathered and hand-picked because they are worth your time. Every post here touches on cloud security in some way — the news, the analysis, the deep dives, and the occasional surprise find. Acme AI is the next-generation, AI-powered spreadsheet platform built to replace Excel and redefine how analysts, data scientists, and enterprise teams work with data. New stories are added to this page as we find them, so check back if you want to keep up with what is happening around cloud security, or subscribe to the RSS feed to get them as soon as they are published. Browse the collection below, or head back to the homepage to see everything Beyond Market Intelligence is covering right now.
Article: Eliminating Long-Lived Credentials in GCP with Workload Identity Federation
Long-lived service account keys in Google Cloud Platform (GCP) represent a persistent security challenge—difficult to rotate and prone to leakage. Our analysis of scaling Workload Identity Federation across 120+ production projects demonstrates a fundamental shift in machine identity management. Rather than managing secrets, this approach establishes trust relationships, configured once and secured by attribute conditions. Explore how this paradigm change eliminates credential sprawl and enhances overall security.
S3 Compatibility Doesn't Guarantee S3-Level Security
S3 compatibility doesn't automatically equate to S3-level security. Recent research from Wiz highlights critical security gaps in six popular neoclouds offering S3-compatible object storage, revealing a significant disparity compared to Amazon S3’s protections. While S3 has established itself as the industry standard, many services omit key security features. Understanding these differences is crucial for maintaining data integrity. Explore the risks of unowned AI-generated code and potential mitigation strategies, as discussed in our related article, "Presentation: Enchant Your AI and APIs with eBPF Magic 🪄."
How Pinterest Secures AWS Infrastructure at Scale with a Centralized Terraform Pipeline
Pinterest manages its expansive AWS infrastructure with a sophisticated, centralized approach. Recently, they unveiled the Resource Provisioner Pipeline (RPP), a custom Terraform execution engine designed for secure, scalable resource provisioning. The RPP enforces least-privilege access and mandates dual-control reviews, adding critical guardrails to GitHub Actions workflows. This architecture ensures stringent security protocols as Pinterest continues to scale. For further insight into automation strategies, explore “Stripe Uses Graph Search and State Machines to Automate Database Remediation.”
Wiz Discloses CosmosEscape, and Practitioners Debate What Customers Could Have Done
Wiz Research has revealed CosmosEscape, a significant security vulnerability impacting Azure Cosmos DB. This chain allowed an attacker to escape the Gremlin sandbox and obtain a platform-wide key, granting full read and write access to every database. While Microsoft swiftly blocked the initial entry point, remediation took nearly two years. The incident has sparked debate among security practitioners regarding shared responsibility and the true cost of this rearchitecture.
Horizon3 hits $2 billion valuation with $250M Series E as AI threats escalate
Horizon3 has achieved a significant milestone, securing $250 million in Series E funding and reaching a $2 billion valuation. This investment underscores the escalating demand for continuous, AI-powered security validation—a critical shift away from traditional, infrequent penetration testing. As AI threats become increasingly sophisticated, organizations are prioritizing proactive and adaptive security measures. Explore how this trend is reshaping cybersecurity, and delve deeper into AI's role in congressional workflows, as highlighted in our recent article, "Congress’s favorite AI tool? ChatGPT."
Okta buys AI security startup Permiso; source says for about $200M
Okta has acquired Permiso, an AI security startup, bolstering its identity threat detection capabilities in a rapidly evolving landscape. Sources estimate the acquisition price at approximately $200 million. This strategic move directly addresses the increasing need for enterprises to secure AI agents and other non-human identities across cloud environments. As organizations increasingly rely on AI, securing these new identities becomes paramount. For further insights into the burgeoning synthetic user space, explore our coverage of Simile’s recent $200 million funding round.
GKE Security Blueprint Joins Growing List of Cloud AI Frameworks
Google Cloud's new GKE Security Blueprint addresses a critical gap: securing AI workloads as they move from prototype to production. This blueprint outlines a three-layer approach encompassing infrastructure, model integrity, and application security, reflecting the evolving demands of AI deployment. Organizations can confidently navigate this shift by leveraging this framework to bolster their Kubernetes environments. For a deeper dive into AI efficiency gains, explore our related article, "Gemini 3.6 Flash Is Here."
AI Agents with Cloud Credentials Are Outrunning Billing Guardrails Built for Human-Speed Mistakes
AI agents are rapidly outpacing existing cloud billing safeguards. Recent incidents, including a $14,000 AWS bill incurred by a single agency due to compromised credentials and excessive Bedrock usage, highlight a critical gap. Following May's $6,531 infrastructure provisioning event with DN42, practitioners observe that cloud billing often lags a full day behind agent-driven spending. This discrepancy demands immediate attention as organizations increasingly adopt agentic AI—as underscored by Stripe’s recent benchmark revealing agent integration challenges.