Misconfigured storage, permissive IAM, and forgotten assets are still the top drivers of cloud exposure.