Pejman Tabassomi, Field CTO for EMEA, Datadog
Credential theft continues to pose a significant risk for enterprises operating in the cloud. In this environment, both human and machine identities now constitute the new security perimeter, meaning that a single leaked credential can provide attackers with access to an organisation’s most sensitive data. This risk has prompted teams to rethink their security models and develop new strategies (such as data perimeters and multi-account governance) to reduce exposure while maintaining operational agility.
The growing risk of credential theft
In cloud production environments, a crucial aspect of security involves automating repetitive tasks that are prone to human error when performed manually. Continuous integration and delivery (CI/CD) pipelines, for example, are responsible for deploying changes to infrastructure and applications. While these pipelines, often managed with Infrastructure as Code (IaC) tools or provider-specific scripts, help reduce human error, they also introduce potential vulnerabilities.
Credentials are a prime target for malicious actors as demonstrated by a massive data breach earlier this year, which exposed 16 billion login details. A common cause of data breaches in cloud environments is the misuse or leakage of long-lived credentials, as highlighted by our 2024 study. CI/CD pipelines typically run with elevated permissions, allowing leaked credentials to grant attackers extensive access to critical infrastructure.
The most effective way to mitigate these risks is to use short-lived access credentials that automatically expire after a short period. This limits the potential damage if they are compromised. However, our 2025 report shows that many organisations have not yet adopted this approach. For example, only about three in five companies using GitHub Actions rely exclusively on this more secure, “keyless” method of authentication. The rest still depend on older, long-lived access credentials that remain valid indefinitely, leaving them significantly more vulnerable if those keys are compromised.
Because APIs are exposed by design, attackers no longer need to infiltrate a network to compromise a system. Valid credentials alone are sufficient for access.
New strategies
In response, organisations are adopting new strategies to protect their cloud environments beyond traditional network boundaries. One such approach is the use of data perimeters, which restrict access to cloud resources based on trusted networks, accounts, or organisational boundaries. According to the recent “State of Cloud Security” report, 40% of organisations have already established data perimeters (a notable achievement given the complexity involved). The most common implementation methods include S3 bucket policies, which limit access to approved AWS accounts, and VPC endpoint policies, which prevent unauthorised data exfiltration. A smaller number of organisations extend these boundaries at the organisational level to ensure that critical resources cannot be accessed from outside the enterprise.
Another emerging strategy is multi-account governance. Managing minimal privileges within a single account can be challenging, leading many teams to use platforms like AWS Organisations to centrally manage multiple AWS accounts and enforce top-down security guardrails. This approach is gaining traction, with 86% of companies using multi-account structures, more than 70% of which include all accounts within the organisation.
Both strategies (data perimeters and multi-account governance) reflect a growing concern over credential theft and a willingness to adopt provider-supported guardrails to protect cloud data.
Legacy credentials: an ongoing risk
Despite these advances, long-lived credentials continue to pose a significant threat. The report found that 59% of AWS IAM users, 55% of Google Cloud service accounts, and 40% of Microsoft Entra ID applications had access keys older than one year. Even more concerning, the proportion of keys older than three years has increased across multiple cloud providers, creating unmonitored access points that are rarely rotated and sometimes remain active in unused systems.
While 79% of organisations now use federated authentication for human users accessing the AWS console, through services like AWS IAM Identity Centre or Okta, almost two in five still depend on IAM users somewhere in their environments, with one in five using them exclusively. Many of these credentials are not only outdated but also unused. Over half of AWS IAM users with keys older than a year had not used them in the previous 90 days. This stagnation suggests that while organisations are starting to adopt modern practices, legacy credentials continue to be a persistent vulnerability.
Observability as a security enabler
As the traditional network perimeter fades, observability has become a pillar of enterprise security. In an environment where attackers exploit valid credentials to blend in with regular activity, having visibility across systems, workloads, and identities is vital. Observability enables teams to detect vulnerabilities, validate controls, and respond to indications of compromise before issues escalate.
Unlike traditional monitoring, which typically focuses on collecting logs and metrics, observability creates a shared operational view. This allows engineering, operations, and security teams to correlate activities, trace events back to their sources, and understand behaviours across the entire environment. This capability is particularly valuable in addressing credential theft, as it highlights anomalies and links suspicious activities to known attacker tactics.
Observability also drives continuous improvement. By tracking detection efficiency, response times, and alert accuracy, organisations gain insights into the effectiveness of their defences. Additionally, it supports compliance by providing empirical evidence that security controls are functioning as intended, and it strengthens the defensive ecosystem by turning visibility from reactive firefighting to proactive investigations.
Towards continuous, contextual security
In today’s cloud environments, the security perimeter is no longer a fixed boundary. Every user and machine account represents a potential entry point to critical data. As attackers increasingly exploit stolen or compromised credentials, implementing robust access controls, using short-lived credentials, and ensuring continuous verification have become essential.
The path forward involves combining multiple strategies into a global, adaptive defence. Short-lived credentials, clearly defined data perimeters, multi-account governance, and deep observability work together to provide contextual awareness across all interactions in the environment. Observability, in particular, enhances understanding of credential-based threats by connecting signals across users, systems, and networks, allowing teams to detect misuse early and take decisive action.
Security in the cloud era is no longer about building higher walls. It is about maintaining continuous, contextual awareness of every interaction, building defences in visibility and intelligent automation, reducing the impact of credential theft, and strengthening trust in systems and operational resilience.
