Cloud Didn't Add Risk. It Deleted Controls You Never Wrote Down.

A few years into a large migration, I watched a platform team of six provision more infrastructure in a Tuesday afternoon than the datacenter group it replaced had built in a year. Everyone in the room treated that as the win, and by any reasonable measure it was.

Nobody asked the other question. What had been protecting us during that year, besides the firewalls we could name?

The controls nobody put in the framework

Take the part that is not in dispute. Cloud providers run better infrastructure security than almost any private datacenter. They patch faster, encrypt more by default, and produce logging that no in-house team was ever going to build. The shared responsibility model is well understood and misconfiguration is a known and heavily tooled problem. None of that is what this is about.

Go back to that datacenter and list what actually stood between an attacker and your customer database. Not the controls in your framework. Everything.

Procurement took eleven weeks, so an attacker could not spin up their own compute next to yours. A change advisory board met on Thursdays, so a firewall rule could not appear on a Tuesday. Somebody had to be physically present to touch a rack. The database sat on a network segment that existed because of where the cable ran, not because anyone designed it. Egress went through a proxy that logged, because that was the only way out of the building.

Not one of those appeared in a control matrix. Every one of them was doing security work, every day, for free.

Which is the thing worth being clear about. Cloud did not create new risk so much as it deleted a set of controls you never wrote down, and you cannot deliberately replace a control you never knew you had.

The same theft, run twice

Take a developer laptop and a stolen session token. Run that event in both environments.

In the old one, the attacker holds a token for a workstation. They now need VPN access, and the VPN needs a second factor. Then they need to work out which of four hundred internal hosts matters. Then they need credentials for the specific database, which live somewhere else. Then they need a path out of the building, and the only path runs through a proxy that logs volume. Six distinct obstacles, and at most two of them were designed as security controls. The other four were accidents of how buildings and cables work.

In the new one, the same token is a cloud identity. The identity has a role. The role has read access to object storage because someone needed it during a migration in 2023 and nothing revoked it. One command copies the bucket to infrastructure the attacker rented an hour ago with a stolen card.

The difference is not that the second environment is careless. The IAM policy is a genuinely better control than any of the six, more precise, more auditable, more revocable. The difference is that one deliberate control replaced six accidental ones, and nobody ran the arithmetic on that trade at the time.

The 2026 Verizon Data Breach Investigations Report, built on more than 31,000 incidents and over 22,000 confirmed breaches, found that only 23 percent of third-party organisations had fully remediated missing or improperly secured multifactor authentication on their cloud accounts. The single deliberate control that was supposed to carry the weight of everything friction used to do is absent or broken in most of the places it was checked.

Where the friction went, and who inherited it

The same report found that 48 percent of breaches involved a third party, a 60 percent increase year over year.

That number is usually read as a supply chain story, and it is one. It is also the friction story from a different angle. In a datacenter, a third party who needed access to your systems had to be badged in, or given a VPN account someone provisioned by hand, or handed a cable. Each of those left a person, a record and a delay behind it.

A modern integration is an OAuth grant approved in a browser in eleven seconds. The access is often broader, lives longer, and has no natural expiry, because nothing physical has to be handed back. Friction was doing lifecycle management for you, badly but continuously, and nothing took over the job.

The objection that mostly holds

There is a strong argument against reading any of this as a criticism of cloud, and it is worth stating at full strength rather than as a straw man.

On-premises was worse. Demonstrably, measurably worse. Those six obstacles were unreliable, undocumented and invisible, which means they could not be tested, could not be evidenced to an auditor, and failed silently. Nobody ever ran a control test on procurement lead time. Meanwhile cloud providers hand you encryption, logging, identity federation and network isolation that a mid-market company could never have built. Longing for accidental controls is nostalgia, and nostalgia has no place in a security program.

All of that is correct, and it does not touch the argument.

The comparison that matters is not cloud against the datacenter. That question is settled. The comparison is cloud with an inventory of what was deleted against cloud without one. Providers made far better controls available and simultaneously removed a set of implicit ones. Those two facts are independent of each other. Most organisations enthusiastically captured the first and never once audited the second, which is why a single over-broad role can now do what previously required a break-in.

How to find what you deleted

This is a two-day exercise for one senior engineer and it does not need a tool.

Pick your three most sensitive data stores. For each, write out every step an attacker would have had to complete in your pre-cloud architecture, including the ones nobody would call a control. Then mark each step with one of three labels. Deliberately replaced, and here is the control that replaced it. Deliberately accepted, and here is who accepted it. Or nobody noticed until now.

The third bucket is the whole point of the exercise, and in every organisation I have run this with, it is not empty.

Three questions to raise on Monday. If a single developer identity in your environment were fully compromised right now, name every distinct obstacle between that identity and your most sensitive dataset. Count how many of those obstacles are deliberate, documented controls rather than side effects of how something was built. And ask when each one was last tested by someone trying to get past it.

If the count comes back at one, that is not unusual and it is not a scandal. It is the predictable result of replacing an architecture full of accidental friction with one that has almost none, and doing it without an inventory.

What this buys you

Not a longer control list. A shorter and more honest one, where each entry is deliberate and someone can say what it replaced.

It also changes how the next migration goes, and there is always a next migration. The first question stops being what does this let us do faster and becomes what was quietly holding the line here, and what are we putting in its place. That question costs a day and it is the cheapest thing in the entire program.

Leadership and the board are usually told that the cloud environment is more secure than what came before. That statement is true and it is incomplete, and the missing half is a list nobody has written.

Speed was never free. It was paid for with controls that nobody had bothered to name, and the invoice arrives later.