When a Cloud Breach Isn't About the Cloud — It's About Access

Amgen's recent disclosure to the SEC is a reminder of how quickly a routine cloud environment can become a liability. The biotech giant reported that attackers exfiltrated proprietary data and patient health information from cloud systems operated by third-party providers — the latest in a string of healthcare and biotech breaches this year tied to attackers targeting cloud-based platforms rather than on-premises infrastructure.

 

The details Amgen has shared so far are limited: which providers were affected, how the environments were compromised, and how many patients were impacted are all still under investigation. But the shape of the incident is familiar. Sensitive data sat in cloud systems, someone got in, and the organization is now working backward to understand what was exposed and why.

 

 

The question every cloud breach eventually forces

 

Once attackers are inside a cloud environment, the questions that matter aren't just "what happened" but "what could they reach." Which identities had access to that data store? Were any of those identities carrying more privilege than their role required? Did a misconfigured permission or an orphaned service account create a path from a low-value entry point to high-value data?

 

These aren't hypothetical questions after the fact — they're questions every organization running cloud infrastructure should be able to answer before an incident, not during one. In practice, most can't. Cloud environments accumulate identities, roles, and permissions faster than security teams can review them, and excessive privilege is often invisible until it's exploited.

 

Visibility is the control that's usually missing

 

This is what our IAM solutions at InfoSight are built to address. Rather than treating identity as a one-time provisioning task, our approach gives security teams continuous visibility into cloud identities, roles, permissions, and the access paths connecting them — so excessive privileges, misconfigurations, and other identity-related risks surface before they become the subject of an SEC filing.

 

That visibility only matters if it's continuous. Cloud environments change daily: new roles get created, permissions get copied from one account to another, service accounts get provisioned for a project and never cleaned up. Our platform monitors that environment on an ongoing basis, flagging deviations from least-privilege access as they happen rather than surfacing them in a quarterly audit.

 

And because not every misconfiguration carries the same risk, prioritization matters as much as detection. Our IAM tools help teams rank remediation across cloud resources based on actual exposure — so limited security resources go toward the access paths that could realistically lead to sensitive data, not just the ones that are easiest to fix.

 

The takeaway for security and compliance teams

 

Incidents like Amgen's rarely start with a dramatic exploit. They start with an identity that had more access than it needed, in an environment nobody was watching closely enough. Strong IAM won't eliminate every threat, but it closes the gap between "we didn't know" and "we caught it early" — and that gap is often the difference between a contained incident and a material one.

 

If your organization is still mapping cloud access after the fact rather than monitoring it continuously, now is a good time to change that.