The Cloud Security Gap in Indian SaaS
India's SaaS industry is booming — $18 billion in revenue in 2025 — but cloud security maturity hasn't kept pace. Most Indian SaaS startups use AWS, Azure, or GCP but configure them with default settings that leave critical gaps.
67%Indian cloud deployments with at least one critical misconfiguration (Qualys Cloud Security Report 2025)
23%Indian AWS S3 buckets that were publicly accessible in 2025 (Palo Alto Unit 42)
$4.35 MnAverage cost of a cloud breach globally (IBM Cost of a Data Breach 2025)
45 minAverage time for attackers to exploit an exposed cloud resource (Unit 42 Cloud Threat Report)
The Shared Responsibility Model
WARNING
AWS/Azure/GCP secure the cloud infrastructure. YOU secure what's IN the cloud. This is the single most misunderstood concept. Your cloud provider handles physical security, hypervisor, and network fabric. Everything else — OS patches, application security, data encryption, access controls — is your responsibility.
graph TD
A[Cloud Security
Responsibility] --> B[Cloud Provider
Physical, Network, Hypervisor] A --> C[Your Responsibility
Everything Else] C --> D[Data Encryption] C --> E[Access Controls / IAM] C --> F[OS Patching] C --> G[Application Security] C --> H[Network Configuration] C --> I[Logging & Monitoring] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#1e5f3a,stroke:#10B981,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
Responsibility] --> B[Cloud Provider
Physical, Network, Hypervisor] A --> C[Your Responsibility
Everything Else] C --> D[Data Encryption] C --> E[Access Controls / IAM] C --> F[OS Patching] C --> G[Application Security] C --> H[Network Configuration] C --> I[Logging & Monitoring] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#1e5f3a,stroke:#10B981,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
Top 10 Cloud Misconfigurations We Find in Indian SaaS Companies
| # | Misconfiguration | Severity | % of Companies |
|---|---|---|---|
| 1 | Publicly accessible S3 buckets / Blob containers | Critical | 23% |
| 2 | Overly permissive IAM policies (admin access everywhere) | Critical | 67% |
| 3 | No MFA on root/admin accounts | Critical | 28% |
| 4 | Unencrypted RDS/database instances | High | 31% |
| 5 | Default VPC security group rules (0.0.0.0/0) | High | 54% |
| 6 | No CloudTrail/Activity Log enabled | High | 38% |
| 7 | Secrets hardcoded in application code or env files | Critical | 42% |
| 8 | No backup or disaster recovery plan | High | 51% |
| 9 | Outdated container images with known CVEs | High | 63% |
| 10 | No WAF in front of public-facing services | Medium | 45% |
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanCloud Security Checklist
Identity & Access Management
| Requirement | AWS | Azure | GCP |
|---|---|---|---|
| MFA on root account | Root user MFA | Global Admin MFA | Super Admin MFA |
| No long-term access keys | Use IAM Roles | Use Managed Identities | Use Service Accounts |
| Principle of least privilege | IAM Policies | Azure RBAC | IAM Policies |
| Regular access review | IAM Access Analyzer | Access Reviews | Policy Analyzer |
Data Security
- Encrypt everything at rest — Enable default encryption on S3, RDS, EBS, etc.
- Encrypt in transit — TLS 1.2+ for all API calls and data transfers
- No public storage buckets — Use pre-signed URLs for temporary access
- Secrets in a vault — Use AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager
Network Security
- Private subnets for databases — Never put databases in public subnets
- VPC peering or Private Link — For service-to-service communication
- WAF on all public endpoints — AWS WAF, Azure Front Door, or Cloud Armor
- Security groups as whitelist — Allow only required ports from required sources
Monitoring & Incident Response
- Enable audit logging — CloudTrail (AWS), Activity Log (Azure), Audit Logs (GCP)
- Set up alerts — GuardDuty (AWS), Sentinel (Azure), SCC (GCP)
- Log retention — Minimum 90 days, ideally 1 year
- Automated response — Lambda/Functions to auto-remediate common issues
Key Takeaway
Cloud security is a continuous process. New resources get created daily, configurations drift, and new vulnerabilities emerge. Automated security scanning should be part of your CI/CD pipeline, and quarterly VAPT scans should cover your cloud infrastructure.
Quick Wins You Can Implement Today
- Enable MFA on all admin accounts — Takes 5 minutes, prevents 99.9% of account compromises
- Run a bucket audit — Check all S3/Blob/GCS buckets for public access
- Enable CloudTrail/Activity Logs — You can't detect breaches without logs
- Review IAM policies — Remove any policy with
"Action": ""or"Resource": "" - Run a VAPT scan — Book a free scan at Bachao.AI to get a cloud security assessment
INFO
Bachao.AI's VAPT scans include cloud configuration review alongside web application and API testing. Start with a free scan to see your overall security posture.
Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for cloud security insights for Indian SaaS companies.
