Opinion
Getting in shouldn’t mean taking over
"A compromised application should not become a compromised cloud," writes Naor Talmor, co-founder and CTO of Era Security. "Security needs to enforce that boundary."
Cloud environments change hundreds of times a day across infrastructure-as-code, APIs, management consoles, AI agents, and more. Despite this, many organizations still evaluate their cloud security using periodic scans, sometimes running only once every 24 hours.
For years, cloud security has operated around a reactive cycle: detect a finding, log a ticket, prioritize it, and push a fix. The assumption was that as long as security teams remediated issues quickly enough, they could stay ahead of attackers.
AI-assisted vulnerability discovery and exploitation are putting even more pressure on that already narrow response window.
Our research team at Era recently discovered Greeter, an exploitation framework targeting vulnerable deployments of Flowise, an open-source platform for building AI applications. The visible chat messages said “hello,” while a separate runtime configuration field carried instructions to execute commands. Those commands explored the underlying infrastructure and searched for cloud credentials.
The honeypots we deployed returned mock credentials, and we observed attempts to use them. We did not observe a successful cloud account takeover, but those attempts showed that the attackers were trying to turn application access into broader cloud access.
The vulnerability provided the entry point. What mattered next was which credentials, permissions, and cloud resources the attacker could reach.
This is why cloud security can't focus exclusively on preventing initial compromise. It also needs to limit what attackers can do once they've gained access.
During my time at Aqua Security, I saw how recurring misconfigurations and excessive permissions could undermine cloud security efforts. Teams would fix individual issues, but without enforceable guardrails, a later change could introduce the same exposure again. Each fix resolved an immediate problem without preventing it from recurring.
Today, more frequent cloud changes create more opportunities for exposure, while faster exploitation leaves teams less time to respond. Relying on remediation alone means teams must continually close new gaps before attackers can exploit them.
Traditional cloud security tools help organizations identify misconfigurations and excessive access. But identifying an unsafe configuration does not stop it from being created or used. Security teams still need to assess the risk and coordinate remediation while the exposure remains.
Scanning more frequently isn't enough. Cloud hardening must become a continuous preventive discipline, enforcing guardrails that prevent dangerous exposure and limit attacker access as the environment changes.
A single compromise should not put an entire cloud environment at risk. Getting in should not mean taking over.
Naor Talmor is co-founder and CTO of Era Security.
