What Analyzing Hundreds of Thousands of Cloud Environments Taught Us About Data Exposure

Wiz Research reveals the latest cloud data security trends across hundreds of thousands of real-world environments.

As cloud adoption continues to accelerate, so do the questions facing security teams: Where is our sensitive data? Who can access it?  And are we doing enough to protect it?

To help answer those questions, Wiz Research analyzedhundreds of thousands of cloud accountsacross organizations of all sizes. The resulting report—Cloud Data Security Snapshot: Current Exposure Trends—uncovers the most common data exposure risks and misconfigurations in use today, with a sharp focus on where toxic combinations of access and data are creating real risk.

Here’s a preview of what we found.

Virtual machines and serverless instances are often core parts of cloud infrastructure—and surprisingly often, they’re also exposed to the public internet while containing sensitive data. We found that54%of cloud environments have exposed VMs and serverless instances containing sensitive information like PII or payment data.

Even more concerning:35%of cloud environments have VMs or serverless instances that both expose sensitive data and are vulnerable to high or critical severity threats.

This isn’t just a misconfiguration—it’s an opportunity to dramatically reduce breach potential by targeting high-impact overlaps of exposure and exploitability.

Publicly accessible resources are a normal part of cloud operations. But72% of cloud environments have publicly exposed PaaS databases lacking access controls, raising the risk that sensitive data could beunintentionally exposed. With the right context, teams can differentiate between acceptable public assets and those that pose a genuine threat—and prioritize action accordingly.

Despite years of innovation in container security,12% of cloud environments still have containers that are both publicly exposed and exploitable via known vulnerabilities.It’s a reminder that continuous monitoring and good hygiene are essential in even the most maturecloud-nativeenvironments.

Misconfigurations, exposure, andover-permissioned accountsare still common. But they’re not inevitable. By focusing on the right context—what’s exposed, what’s vulnerable, and what’s sensitive—security teams can get ahead of potential incidents and build a more resilient cloud environment.

Explore the full reportto see how security teams are usingDSPMto turn visibility into action, and risk into results.

This report offers data-backed insights and practical steps to help cloud and security teams close gaps, strengthen posture, and build resilient environments.

Wiz is excited to announce our “Deployed on AWS” status with AWS Marketplace demonstrating our deep partnership with AWS and supporting our customer’s buying decisions

Wiz is excited to announce “The Cloud Hunting Games”, a new hands-on Capture the Flag (CTF) challenge designed to test your cloud incident response skills.

Wiz is excited to bring Data Security Posture Management (DSPM) into our FedRAMP authorized offering. DSPM enables organizations requiring FedRAMP to automate classification, policy enforcement, and continuous monitoring for their sensitive cloud data.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings