Attackers Don’t Break Into Your Cloud. They Log In.

Attackers are not breaking into your cloud. They are logging in.

No exploit, no zero-day, nothing that would set off an alert. They simply come in with legitimate credentials and perform actions that look completely ordinary.

And that is exactly the problem.

Most organisations I know built their monitoring around one idea: detect anomalies. Something unusual, something noisy, something that looks like an attack. But what happens when the attacker does nothing unusual at all?

What this actually looks like in AWS

Attackers use entirely legitimate API calls. The same commands your developers run every day. The same SDK, the same endpoints, the same traffic pattern.

Want an example that should shake you a little? In Amazon Cognito you can configure refresh tokens valid for ten years. Ten years. An attacker who obtains one of those does not need to break in again. They simply keep logging in, legitimately, for the next decade.

Another one: an attacker who deletes an AMI does not merely delete it. In AWS the deletion is permanent. There is no bin, there is no undo. One deletion, entirely legitimate, can destroy your ability to rebuild an entire environment.

And your CloudTrail? It sees everything and understands nothing. Because it is looking for what looks bad, and these actions look good.

The gap is not technological

We see this at AppSec Labs in cloud penetration tests. Clients are confident they are protected because they have alerts on brute force and on suspicious IPs. But nobody is checking what happens when someone with legitimate permissions does things they should not be doing.

That is the gap. Not a technology gap. A thinking gap. The assumption that an attacker looks like an attacker is a dangerous one. In 2026, a good attacker looks like the quietest person on the team.

So what do you do?

Stop looking for anomalies and start looking at behaviour. Not what is unusual, but what does not make sense. Who requested permissions they do not need. Who accessed things unrelated to their role. Who deleted resources at an atypical hour.

If your monitoring is looking for attackers, you are missing them. Look for behaviour.

I first shared a version of this as a LinkedIn post on 2026-05-16. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula