Google Cloud’s H1 2026 Cloud Threat Horizons report examines observed activity from the second half of 2025. The report combines analysis from Google Cloud, Google Threat Intelligence Group, Mandiant, and related security teams.

Its central finding concerns how attackers obtained initial access. Software vulnerabilities represented 44.5% of the report’s observed entries. Weak or absent credentials represented 27.2%. Google says software exploitation overtook credentials for the first time in its comparison.

A PM can summarize research, draft a PRD, and mock up a prototype before lunch. The hard part starts when the team has to decide what actually gets built.

Jira Product Discovery gives product teams one place to capture insights, prioritize ideas with consistent frameworks, and build living roadmaps stakeholders can rally around.

And because it’s connected to Jira, the context behind every decision stays with the work—so developers and their agents know not just what to build, but why.

AI helps PMs move faster. Jira Product Discovery helps the whole team build with confidence.

Get Started for Free

The percentages describe a subset of activity, not every cloud intrusion. They also describe the report’s observation set rather than a universal rate for all providers. That limitation matters when interpreting the apparent shift.

The comparison with the first half of 2025 is substantial. Software exploitation rose from 2.9% to 44.5%. Weak credential entry fell from 47.1% to 27.2%. Misconfiguration declined from 29.4% to 21%.

Exposed sensitive user interfaces or application programming interfaces also declined. The report places that category at 4.9% in the second half of 2025, down from 11.8% earlier.

Google links the change to attacks against external, user managed software. The examples include a remote code execution flaw in React Server Components and a vulnerability in XWiki. The report says these incidents did not breach Google Cloud’s core infrastructure.

The time between public disclosure and broad exploitation also became shorter. Google describes the change as a movement from weeks to days. In several incidents, XMRig miners appeared about 48 hours after a vulnerability was disclosed.

Love him or hate him, Musk moves markets. His next launch hits July 22, and the smart money is already positioning. Our analyst found 3 stocks set to ride it — with entry points and a buy/sell playbook.

Show Me the 3 Stocks

That timing changes the meaning of patch management. A disclosure can become an operational access problem before a normal software update cycle finishes. Google’s report therefore discusses edge controls and automated inspection as ways to reduce exposure during the interval.

The same report presents a different view of cloud incidents through Mandiant engagements. Identity issues supported initial access in 83% of major cloud and software as a service cases. Data was the objective in 73% of cloud related incidents.

The identity category includes more than stolen passwords. The report records voice based social engineering, stolen tokens, compromised third party relationships, and misuse of legitimate access. Seventeen percent of cases involved voice based social engineering.

Third party relationships appeared in 21% of cases. The examples included compromised OAuth tokens connected to a software application and compromised packages used within development workflows.

The report also separates platform access from infrastructure compromise. It describes attackers moving from personal or corporate endpoints into cloud systems. One case involved a Kubernetes environment and cryptocurrency theft after social engineering.

An attempted supply chain operation used an artificial intelligence model to automate credential harvesting and move from a local development environment toward cloud administration. Google says the operation abused OpenID Connect trust in less than 72 hours.

The evidence supports a narrow conclusion. Cloud access paths changed in the observed sample, while identity and data theft remained central. The report does not establish that one control solves the problem.

It instead shows why cloud security reviews need two views. One view tracks software exposure and disclosure speed. The other follows identities, trusted relationships, tokens, and data movement after access.

The report’s figures should also be kept separate from its recommendations. Observed percentages describe what the participating teams saw. They do not measure every region, provider, industry, or type of cloud workload.

You don't have to scroll every AI thread, track every new tool, or watch every demo. 

The Rundown AI breaks it all down for you — the latest AI news, tools, and tutorials in one free 5-minute email every morning. 

Trusted by 2M+ professionals at Apple, Google, and NASA.

Sign up to start learning.