Software vulnerabilities push credential abuse aside in cloud intrusions Cloud intrusions are unfolding on shorter timelines, with attackers leaning more on unpatched software and compromised identities. H2 2025 distribution of initial access vectors exploited in Google Cloud (Source: Google) Google Cloud’s Cloud Threat Horizons Report H1 2026 reflects incident response and intelligence findings from the second half of 2025 and shows how access methods and objectives are changing in cloud and SaaS environments. Third-party software flaws move ahead of credential abuse Unpatched third-party applications became the primary initial access path in observed Google Cloud incidents. Software vulnerabilities overtook weak or absent credentials, marking a shift from earlier intrusion patterns that…