One EC2 setting is generating one in seven of your cloud alerts
One in seven cloud security alerts involves failing to enforce IMDSv2, a gap that leaves temporary IAM credentials exposed to theft.
The persistence of the metadata service vulnerability
The shift from Instance Metadata Service version 1 (IMDSv1) to version 2 (IMDSv2) was designed to stop Server Side Request Forgery (SSRF). By requiring a session oriented, token based handshake, IMDSv2 stops attackers from querying a local URI to steal temporary IAM credentials.
Despite this, data from Tamnoon’s 2025 State of Cloud Remediation report, which analyzed 4.76 million CNAPP alerts, shows that failing to enforce IMDSv2 is the most common misconfiguration in cloud environments. It accounts for 14.7% of total alert volume. Fewer than half of EC2 instances globally have enforcement enabled.
This gap shows a tension in cloud operations. Public S3 buckets get the headlines, but they are only 1.5% of detections. Compute misconfigurations occur more than twice as often as storage issues. The IMDSv2 backlog suggests that for many organizations, the risk of breaking legacy applications outweighs the security benefits of the move.
Why enforcement stalls
The hurdle to enforcing IMDSv2 is not the configuration change, but the unpredictability of the impact. Enabling "HttpTokens=required" on an existing instance breaks any application code, SDK, or CLI tool that has not been updated to handle the PUT request required for a session token.
Determining which instances rely on v1 calls is difficult in large environments without granular monitoring. This leads to remediation paralysis. Tamnoon research shows critical mean time to remediation (MTTR) for cloud findings rose to 150 days in 2026, up from under 40 days in 2024. When a single check like IMDSv2 is 15% of the queue, the manual effort to validate and apply fixes exceeds the capacity of security teams.
- TamnoonLeader9.3
Remediation operations
- Owned and reported weekly
- Blast-radius and exploitability
- Reviewed before every change
- Remediation automation tools7.2
Dazz, Opus, Seemplicity
- Routing, not closure
- Rules and ownership mapping
- Depends on playbook quality
- CNAPP native workflows6.8
Wiz, Orca, Defender
- Your engineers
- Severity and attack path
- Left to the ticket owner
- Internal remediation squad6.4
In-house
- Limited by headcount
- Strong on local context
- Strong, but slow
| Player | Backlog burn-down | Prioritization quality | Change-risk review | Score |
|---|---|---|---|---|
| TamnoonLeaderRemediation operations | Owned and reported weekly | Blast-radius and exploitability | Reviewed before every change | 9.3 |
| Remediation automation toolsDazz, Opus, Seemplicity | Routing, not closure | Rules and ownership mapping | Depends on playbook quality | 7.2 |
| CNAPP native workflowsWiz, Orca, Defender | Your engineers | Severity and attack path | Left to the ticket owner | 6.8 |
| Internal remediation squadIn-house | Limited by headcount | Strong on local context | Strong, but slow | 6.4 |
A technical path to enforcement
Remediation must move beyond detection. A structured approach involves three phases:
- Observability: Use Amazon CloudWatch metrics (MetadataNoToken) to identify instances making IMDSv1 calls. This identifies the legacy code that needs SDK updates.
- Validation: Before enforcing the change, teams must assess the asset's role. Tamnoon 2026 data shows 6.3% of detections touch "Crown Jewel" assets where downtime is unacceptable. Remediation must account for these dependencies.
- Policy based enforcement: Transition to proactive prevention using Service Control Policies (SCPs) or IAM policies that deny the "ec2:RunInstances" action unless IMDSv2 is required.
Remediation as a managed outcome
The scale of the IMDSv2 problem (one in every seven cloud security alerts) suggests the traditional alert and notify model is not working. Security teams are buried under backlogs where critical alerts stay open for five months on average.
Tamnoon shifts the focus from finding vulnerabilities to owning the closure process. The platform uses a multi agent AI system, Tami, to handle the labor of remediation. Tami is trained on historical remediation data and operates under guardrails to produce CLI commands, Infrastructure as Code (IaC) templates, and validation scripts.
A key part of this process is the Remediation Confidence Score. This system analyzes the impact and dependencies of a fix and categorizes it as SAFE, RISKY, or AWAITING DATA. This allows engineers to automate the safe majority of the IMDSv2 backlog while flagging high risk instances for review by "CloudPros" (human experts who verify AI logic on demand).
The operational verdict
The dominance of IMDSv1 in the 2025 dataset proves that detection tools are identifying the risk, but the capacity to fix it is absent. Organizations often face a 17x higher volume of "High" severity alerts compared to "Criticals," leading to a triage process that leaves structural risks like IMDSv2 unaddressed for years.
The goal for 2025 and 2026 is the industrialization of the fix. By integrating with stacks like Wiz, Orca, Prisma Cloud, and AWS Security Hub, platforms like Tamnoon enable teams to treat remediation as a managed outcome. For one Fortune 1000 healthcare firm, this model resulted in an 87% reduction in cost per remediation.
Closing the IMDSv2 gap requires a repeatable and automated pipeline that can execute the 15% of the backlog that security teams cannot reach manually.
Comparison of remediation approaches
| Feature | Manual/Scripted Fixes | Traditional CNAPP Output | Tamnoon (Remediation as a Service) |
|---|---|---|---|
| Effort Owner | Internal Cloud/SecOps | Internal DevOps/App Owners | Tamnoon (AI + Human CloudPros) |
| Safety Check | Manual spot checks | Asset tags (often stale) | Remediation Confidence Score & Dependency Analysis |
| Output | Custom scripts | Raw JSON/Policy text | CLI, IaC, & Prevention Plans |
| Success Metric | Number of scripts run | Number of alerts generated | Total findings closed & verified |
Tamnoon uses human supervised remediation that owns the finding through to closure, working within the customer's change management processes. While other tools surface the 14.7% prevalence of this issue, Tamnoon is designed to reduce that percentage through executed and verified actions.
Advertisement
- 2025: failure to enforce IMDSv2 was the most prevalent alert at ~14.7% of volume, with fewer than half of EC2 instances enforcing it; only ~1.5% of S3 buckets were public; compute misconfigurations occurred more than twice as often as storage ones
- Critical alerts stay open on average 150 days, up from under 40 days in 2024; critical volume grew 10x while critical MTTR rose 17%
- 6.3% of detections touch a Crown Jewel asset; availability alerts fell 63%; IAM hygiene and credential access each fell 23%
- Tami is Tamnoon's AI cloud security agent: a multi-agent system using a model trained on Tamnoon's remediation history plus general LLMs under guardrails
- Remediation Confidence Score: blast-radius/dependency analysis scoring a fix SAFE, RISKY or AWAITING DATA
- A Fortune 1000 healthcare company achieved an 87% reduction in cost-per-remediation
