Rethinking Your Threat Models for the Cloud by Kat Traxler

This post explains how cloud architecture and publicly exposed control‑plane APIs change the attack surface compared to traditional on‑prem environments, describing attack progression (initial compromise, cloud privilege escalation, IAM-based persistence) and cloud‑native data exfiltration over the CSP backbone; it warns that network- and host-based sensors are insufficient and that defenders must rely on control‑plane logs and cloud-native detection strategies.