Blog
What we learn reading clouds: short, factual notes on cloud security as we meet it.
- 11 October 2026What a cloud attack path is, and how we score it out of 100An attack path links an entry point from the internet, a weakness and a target. Here is how Ctadel builds it and why its risk score fits in a number from 1 to 100.Read the article3 min read
- 8 October 2026CVSS, EPSS, KEV: three numbers so you stop fixing vulnerabilities in the wrong orderThe CVSS score gives theoretical severity, EPSS the probability of exploitation, the KEV catalogue what is already exploited. How to read them together, and why the machine’s context matters more than all three.Read the article3 min read
- 5 October 2026Agentless does not mean read-onlyAn agentless cloud scanner reads your accounts through their APIs. But to read inside a disk or a database, it has to create copies in your account. Here is exactly which permissions Ctadel asks for, and which ones you can refuse.Read the article3 min read
- 29 September 2026Scaleway, OVHcloud, OUTSCALE: why treat them on par with AWSMost cloud security tools cover AWS, Azure and Google Cloud and stop there. Here is what it takes to cover a French cloud with the same scanners, and what it changes for a team that uses several.Read the article3 min read
- 22 September 2026IMDSv1: how an ordinary web bug becomes a cloud account takeoverAn instance’s metadata service hands its credentials to whoever asks. With an SSRF, that is the attacker. What the Capital One case showed, why IMDSv2 exists, and how to check your instances.Read the article3 min read
- 15 September 2026The ten cloud misconfigurations found in almost every accountPublic buckets, security groups open to the world, access keys never rotated, logging disabled: ten routine settings that show up in most incidents, with what to check for each.Read the article3 min read
See it on your accounts
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.