Hendrik Krüger, Cloud On Demand
Ask most organisations how secure their cloud environment is and you get an inventory of acronyms. We have cloud security posture management (CSPM). We have endpoint detection and response (EDR) on every device. We are on Microsoft 365 E5. All of those can be true while genuine detection capability sits close to zero.
A licence grants access to capability. It is not a control. The distance between the two is where incidents live.
It shows up three ways. The capability was never switched on, because enabling it needed design decisions nobody was tasked with making. Or it was switched on and never tuned, so its alerts are ignored within three weeks. Or it is configured accurately and nobody is rostered, and the alert lands at 2:14am on a Saturday in a mailbox next opened at 8:30am on Monday. All three pass a documentation-based audit. None survives an intrusion.
Identity is where this costs most. The dominant intrusion pattern in cloud is not a novel platform flaw. It is authentication with a valid credential, phished, re-used or bought. The adversary rarely breaks in. They sign in. The signals are already being generated in most cloud tenants: risky sign-ins, anomalous consent grants, suspicious inbox rules. The alert fires correctly, then waits for someone who has not been told it is their job to look.
Consider a composite drawn from mid-market patterns rather than any one company. Saturday, 1:40am, a phished finance credential authenticates from another country, the multi-factor authentication (MFA) prompt relayed in real time. At 1:52am, an inbox rule buries anything mentioning invoices. At 2:15am, a consent grant gives a third-party application mail access that survives a password reset. At 3:10am, four customers receive changed banking details on a real invoice thread. Every event produced telemetry, correctly captured, and nobody read it until 9:20am on Monday.
Run the same sequence against an organisation with detection discipline. Severity escalates automatically because the account has finance system access. A contextual alert reaches the on-call engineer by phone, carrying the risk signals and the containment actions already authorised. The account is disabled and its tokens revoked 11 minutes after the first sign-in.
The reporting layer is the easy half. Standing up posture management, identity monitoring and attack surface discovery is largely a procurement and engineering challenge. The harder question is what happens when something real is detected, who is authorised to act without approval and how long it takes. Every containment action worth having needs a named role that can execute it unilaterally, a written procedure and a rehearsal in the past 12 months.
It also means accepting that containment precedes certainty. A reversible action against a false positive costs an inconvenienced user and an apology. A two-hour wait against a true positive costs considerably more.
Governance tells you who owns the risk. Only detection discipline tells you whether anyone is watching it, and that is the half tested at two in the morning.
From detection to response
Deciding in advance what happens at 2am is the difficult part, and few mid-market teams can staff it alone. Cloud On Demand distributes BlueVision's Fusion Cloud, pairing continuous attack surface monitoring with managed detection and response, so a real signal reaches someone rostered to act on it. Visit www.cloudondemand.co.za or e-mail info@cloudondemand.co.za to learn more.
