Datadog’s report analyzes security posture data from a sample of thousands of organizations that use AWS, Azure or Google Cloud. In its research, Datadog found that 40% of organizations are using data perimeters—a high number considering that implementing data perimeters is an advanced practice. The most popular way to implement data perimeters was through S3 bucket and VPC endpoint policies.
Another strategy teams are employing to reduce security risk is multi-account environments. Enforcing minimal privileges in a single account is challenging, which is why centrally managing multiple accounts through AWS Organizations has become a security best practice. This approach enables teams to enforce security invariants across all accounts with top-down guardrails. Datadog found that adoption of platforms like Organizations is widespread—86% of companies use multi-account within an AWS Organization, with more than two in three (70%) having all their accounts part of an Organization.
Part of the reason teams are implementing new security strategies is that credential theft remains a major attack vector, a problem that is exacerbated by long-lived credentials that never expire and frequently get leaked in source code, container images, build logs and applications artifacts. This year, 59% of AWS IAM users, 55% of Google Cloud service accounts and 40% of Microsoft Entra ID applications had an access key older than one year.
“Every identity—human or machine—represents a potential entry point to our critical data,” said Emilio Escobar, CISO at Datadog. “Strong access controls and continuous verification aren’t just security features; they’re foundational to protecting our assets in today’s borderless environment.”
