A new report by Tenable has revealed that organisations in Singapore and Southeast Asia are quietly facing major cloud security threats, many of which could lead to data breaches, financial loss, or regulatory penalties if left unaddressed.
The 2025 Cloud Security Risk Report highlights troubling gaps in cloud infrastructure, pointing to misconfigured storage, embedded secrets, and limited visibility as key vulnerabilities that expose sensitive data as Tenable found that 9% of all cloud storage resources it analysed contained restricted or confidential information which is translating to millions of exposed records in environments that handle massive data volumes. Even more concerning, nearly 1 in 10 publicly accessible cloud storage locations held sensitive data due to weak access controls or misconfigurations.
These findings are particularly alarming for businesses in tightly regulated environments. In Singapore, where legislation like the Cybersecurity Act, PDPA, and MAS Technology Risk Management Guidelines enforce stringent data protection standards, such missteps could result in serious compliance breaches. Similar rules apply across Southeast Asia, with countries like Indonesia, Malaysia, Thailand, and the Philippines enforcing their own versions of data privacy and cloud security laws. With cross-border data flow regulations becoming more rigid, the need for proper cloud governance is more pressing than ever.
Tenable’s research also shines a light on the hidden threats within cloud-native services, with the report noting that 54% of organisations using AWS ECS have secrets embedded in task definitions, while 3.5% of AWS EC2 instances were found with credentials in user data. These oversights potentially give attackers direct pathways to compromise or fully take over cloud environments.
“Secrets are the keys to the kingdom, yet many organisations are unknowingly leaving them unguarded across their cloud infrastructures,” said Ari Eitan, Director of Cloud Security Research at Tenable. He cautioned that without good security hygiene around secrets, organisations risk turning minor breaches into devastating compromises.
With Singapore ramping up its cloud initiatives—including frameworks like IMDA’s Cloud Outage Incident Response (COIR)—the report calls for a more proactive, risk-aware approach to cloud security. “The cloud offers incredible agility, but without strong controls and continuous monitoring, it also opens the door to significant exposures,” Eitan added. He stressed that visibility into sensitive data and access permissions must become a board-level concern.
