Five Reasons Endpoint Agents Do Not Offer Enough Protection on AWS
Author
Naj Husain
Date Published
Security and operations have always relied on agents for threat detection, backups, vulnerability analysis, and more. Endpoint agents are widely used in securing IT environments, but deploying, updating, and managing them can be difficult. In cloud environments, the complexity increases as IT teams may only control some deployed workloads (due to Zero Trust), requiring constant effort to ensure that developers deploy agents.
In this blog, we discuss five security limitations of endpoint security agents: lack of coverage, deployment difficulties, an increased attack surface, high susceptible privileges, and ease of avoidance by attackers. We also cover how adding agentless solutions can improve your AWS environment's threat detection, response, and recoverability.
Security agents fail to provide full coverage.
DevOps teams primarily focus on performance and operability, and are typically responsible for managing cloud resources. Although security is important, it isn’t their primary focus and can get overlooked. Without proper attention to security, workloads may be deployed without a security agent, creating vulnerabilities in cloud workload protection and hindering the achievement of complete coverage. Our research shows that less than 25% of the instances in AWS are covered by an endpoint protection agent.
<img loading="lazy" decoding="async" class="aligncenter" src="http://localhost:10003/wp-content/uploads/2023/01/cloud-protection-change-my-mind-meme.jpg" sizes="(max-width: 654px) 100vw, 654px" srcset="http://localhost:10003/wp-content/uploads/2023/01/cloud-protection-change-my-mind-meme.jpg 654w, http://localhost:10003/wp-content/uploads/2023/01/cloud-protection-change-my-mind-meme-300x224.jpg 300w" alt="a meme about aws endpoint cloud protection" width="654" height="488" />
Security agents are susceptible to supply-chain attacks.
Supply chain attacks are rising and will continue to be in 2023. An advanced attacker can infiltrate an agent vendor's production environment, introducing harmful code into the product's source code. Once the infected updates are installed, the customer's environment becomes compromised. An example is the widespread SolarWinds attack, which impacted thousands of networks globally. Another example is the ransomware attack on Kaseya, an IT management software company, in which a previously unknown vulnerability in their management servers enabled attackers to push malicious software updates to the devices of the MSP's customers. The attacker then used this privileged access to spread ransomware to hundreds of networks.
Security agents are present on a company's most valuable resources, often running with elevated permissions that can be easily exploited. Additionally, the agent activity may not be closely monitored, making it less likely for an attacker to be caught, otherwise known as “Dwell Time”. As a result, sophisticated adversaries may view security agents as desirable targets for a supply chain attack.
Agentless solutions rely on cloud permissions for their analysis, giving you control over their access level. Additionally, every action they perform is recorded and monitored by the cloud platform logs, making it less likely for them to be exploited.
Security agents are searched for and bypassed by attackers.
When attackers gain access to a AWS workload, they first check all the running processes and services, specifically which security agents are present. After identifying the security agents, attackers can better plan their next steps based on their knowledge of how the agent operates. For example, Grasshopper, a nation-state malware framework, scans for specific personal security products (PSPs) installed on the target operating system before executing its modules to avoid being detected.
An intelligent attacker can avoid detection or even completely neutralize any security agent. Bypass techniques and proof of concepts are constantly published by security researchers and used by attackers, making it easier and easier to avoid all of an agent's sophisticated detection and prevention mechanisms. Most of them are design flaws that persist in all the endpoint protection agent versions and can therefore be consistently bypassed.
Our research shows that out of all the VMs that were infected with malware, 27% of them had security agents deployed (meaning the agent either proved ineffective or was bypassed by the attacker).
Security agents require resources and time to deploy.
The effort to deploy and maintain an agent-based solution is linear to the size of the AWS environment, whereas agentless solutions are deployed once per cloud organization. Consider, for example, the deployment of an agent-based solution when protection against ransomware and malware threats is needed — the time required to achieve full coverage with an agent is too long, a time in which you are unprotected and could be easily breached.
In diverse environments, you have Windows servers, Linux servers running various AWS workloads, some customer-facing, many built-in applications and configurations on those workloads, and so on. When you deploy, patch, or upgrade an endpoint agent directly on the machine, the result is only sometimes 100% successful since the agent software is incompatible with existing configurations.
Conversely, an agentless solution is immutable, easy to deploy, cost-effective, and provides immediate visibility and actionability when needed.
Security agents increase the attack surface.
Any additional software, program, or agent on AWS workloads extends the attack surface for possible attackers. Rather than forcing malicious actors to rely solely on the limited attack surface with built-in operating system features, each additional piece of software expands that attack surface to include more proprietary code on the machine.
Vulnerabilities in security agents can be even riskier due to the high privileges the agents require for running processes on the operating system. And when one considers the difficulty in maintaining security agents, it is expected that many agents deployed in cloud environments must be updated with the latest available version, leaving unpatched agents exposed and vulnerable.
Conclusion: AWS environments require cloud-native cyber recovery
Endpoint security agents still have an essential role in an organization's security. But as technology evolves, environments change, and threat actors learn how to evade and even utilize agents to their own needs. Agent-based security solutions alone are insufficient, especially in dynamic and complex cloud environments. Currently, emerging scanning techniques pave the way to a new agentless cyber recovery approach that has zero impact on the production environment.
About Elastio
Elastio detects and precisely identifies ransomware in your data and assures rapid post-attack recovery. Our data resilience platform protects against cyber attacks when traditional cloud security measures fail.
Elastio’s agentless deep file inspection continuously monitors business-critical data to identify threats and enable quick response to compromises and infected files. Elastio provides best-in-class application protection and recovery and delivers immediate time-to-value.
Recover With Certainty
See how Elastio validates every backup across clouds and platforms to recover faster, cut downtime by 90%, and achieve 25x ROI.
Related Articles
Ransomware has evolved beyond disruption Ransomware has evolved beyond disruption; It now threatens business survival. Malware creates exposure, but once ransomware encrypts your data, the real risk is losing the ability to recover. Picture the boardroom: a director leans forward and asks the CISO a simple question: If ransomware hits tonight, can you prove we’ll recover without compromise? The room goes quiet. In that moment, the CISO realizes prevention is expected—but proof of recovery is what truly matters.This is the existential challenge every enterprise faces today: guaranteeing recovery that is provable, uncompromised, and fast enough to keep the business running. Here are five questions every CISO must ask going into Q4 or 2026: 1. Can we prove that your backups are free of ransomware? Backups that contain hidden encryption or dormant malware are liabilities, not assets. Without continuous validation of backup integrity, recovery risks reintroduce ransomware into production. Boards should press for evidence-based assurance that every backup is verified, uncompromised, and ready to support recovery. Anything less is not resilience—it’s roulette. 2. How quickly can we identify a clean recovery point? Downtime costs escalate minute by minute. Manual validation is too slow, and attackers know it. An AI-driven recovery platform can accelerate the detection of clean recovery points, enabling day-zero recovery. Speed to recovery is no longer just a technical metric—it is a competitive advantage that protects revenue, brand, and customer trust. 3. Are recovery processes embedded into our workflows? Recovery cannot sit on the sidelines. It must be built into daily operations—integrated with security tools, cloud platforms, and incident response. When recovery is operationalized, it reduces risk, eliminates human error, and ensures resilience is invisible but indispensable. 4. Do we have provable evidence of clean recovery? Boards, regulators, and customers no longer accept verbal assurances. They expect audit-ready proof that recovery is uncompromised. Recovery is not just a technical function—it is a fiduciary responsibility. CISOs and executive leadership must be able to show verifiable resilience to those who hold them accountable. 5. Are we ready for AI-driven decision-making? As AI systems increasingly automate critical workflows, resilience must become autonomous and self-healing. Future-ready organizations will rely on AI to detect, validate, and recover—without manual intervention. But those systems can only be trusted if they operate on clean, uncompromised data. Final Thoughts: Closing the Missing Control Traditional security and immutable backups are no longer enough. The missing control is data integrity verification—the assurance that every recovery point is clean and trustworthy. Without it, cyber resilience remains a gamble. Elastio closes that gap. By validating backups, detecting ransomware at day zero, and delivering provable recovery assurance, we enable CISOs to demonstrate resilience with confidence—to boards, regulators, and customers alike. CISOs who can prove recovery don’t just mitigate ransomware risk. They redefine resilience as a board-level business advantage—the difference between disruption and survival. Whether you're a CISO, IT lead, or cyber champion, this piece offers strategic insights to rethink your cybersecurity posture. Ready to explore how Elastio can fortify your defense-in-depth strategy—and why it’s emerging as a must-have for ransomware readiness? Let’s dive in. Learn More at www.elastio.com/platform
We all run malware scanners. They catch trojans, spyware, and viruses. But ransomware is different. If you rely on malware scanning alone, you’re under-protected. Ransomware attacks in 2025 are more costly, sophisticated, and more damaging than ever. Relying on malware scanning alone is no longer sufficient. CISOs must pair it with modern ransomware behavior detection to ensure true resilience. What Makes Ransomware Different? Malware scanners focus on known malicious code. Ransomware often uses code for malicious purposes, encrypting, deleting, or stealing your data for extortion. The real threat is what it does, not what it is. Signature-based detection, common in malware scanners, matches files against known patterns or hashes. It’s reactive, only flagging threats that are already cataloged. Modern ransomware often uses polymorphic or encrypted code to evade these checks. According to CrowdStrike’s 2025 Global Threat Report, 79% of detections were malware-free. Behavior-based detection watches for ransomware-specific actions, like slow file encryption, mass renaming, or randomized file names, and can catch threats even without known signatures. Bottom line: Malware detection helps block entry. Ransomware encryption detection helps limit the damage. Both are needed together. 2025 Ransomware Reality: Escalating Costs, Complex Attacks Ransomware isn’t just frequent; it’s expensive. In 2024, ransomware payments dropped 35% globally to $813 million, yet average payouts soared to around $2 million The GuardianDeepStrike.Some attacks cost organizations much more, estimates put total ransomware-related loss (including downtime, recovery, and reputational damage) at around $5.13 million in 2024, expected to rise to $5.5–6 million in 2025 PurpleSec.Recovery costs alone (excluding any ransom payment) dropped to $1.53 million in the latest data, down from $2.73 million in 2024, but that shows resilience improvements, not low-risk Grey Matter.Ransomware still accounted for 91% of all incurred cyber-insurance losses in the first half of 2025, Axios. These numbers show how critical behavior-based detection is, not just to stop the attack, but to limit damage and cost. Ransomware Infects Backups Backups feel like a safety net. If production gets hit, you can restore. The problem is, backups themselves can be poisoned. Ransomware doesn’t have to delete your backups to make them useless. It just has to contaminate them. Many teams assume immutability and isolation are enough. “If attackers can’t reach my backups, they can’t hurt me.” But that misses the point: if you’re backing up corrupted or encrypted data, you’re just preserving the damage. When you restore from those backups, you don’t recover your business; you extend your downtime. That’s why ransomware scanning of backups, snapshots, and vaults before restore is critical. It ensures your recovery points are clean and usable when you need them most. The End Result Is The Real Risk Attackers aren’t satisfied once they’re inside. They care about the outcome: encrypted data, stolen files, business disruption, and extortion leverage. Some don’t even encrypt; they steal data and threaten to leak it (“double extortion”). If you only scan for malware, you miss these stages. Ransomware scanning focuses on ransomware-specific behavior, like data staging, rapid or slow encryption. Real Business Impact A single ransomware incident can devastate an organization. Recent victims have lost millions, faced regulatory penalties, and collapsed after failed recoveries and reputational damage. One German device-insurance firm paid $230,000 to attackers, but the real cost was far greater. They cut staff from 170 to eight, sold their headquarters, and ultimately entered insolvency (Tom’s Hardware) That’s a dramatic reminder that ransomware isn’t just disruptive; the damage can be severely business impacting and permanent. CISOs: Critical Action Items for 2025 Scan data-at-rest, including backups, replicas, and vaults, proactivelyMonitor ransomware behaviors, watch for mass encryption, exfil staging, or slow encryptionProve your recovery is clean, build confidence with your board and regulators by certifying your backups are ransomware-free.Use both malware + ransomware scanning. Cover the entry points (malware) and the destructive outcome (ransomware encryption).Practice recovery and response: Regularly test restoration, incident reporting, and communication workflows to reduce downtime and risk. Final Thoughts Malware scanners are critical, but insufficient against today’s ransomware. Ransomware is path-driven and outcome-based. To protect your backups, data, and business continuity, you need behavior-based ransomware detection on top of malware scanning. Whether you're a CISO, IT lead, or IT resilience advocate, this piece offers strategic insights to rethink your cybersecurity posture. Ready to explore how cyber vaulting can fortify your defense-in-depth strategy—and why it’s emerging as a must-have for ransomware readiness? Let’s dive in. Learn More at www.elastio.com
DevOps teams are increasingly responsible for software as a service (SaaS) decisions to solve specific problems for business operations. SaaS aims to meet these demands by providing turnkey solutions for CRM, ERP, and CMS processes. While SaaS platforms may be designed for privacy, many fail to provide adequate capabilities for data governance or data retention (data protection). Further, little to no attention is given to malware and ransomware detection within the content stored inside the SaaS platform. This blog post and included use case aims to explore these problems in greater detail and offer an innovative solution for the challenges. Safeguarding Content Management Systems as a Service Content Management Systems as a Service (CMSaaS) is an example of a SaaS platform that meets the immediate demand for agility but introduces complications for the Security Office. While CMSaaS takes appropriate measures to protect privacy and confidentiality against external actors, it seldom considers the confidentiality of the data handled by data-protection administrators. Many CMS platforms offer, at best, click-ops* capabilities to create and download unencrypted backups of the entire CMS to their desktop. While some CMSaaS offer APIs to initiate full backups, retention policies may be limited to 30 days with no concern for governance or deduplication. Further complicating the challenge described is that CMSaaS platforms are a likely place to store and share malware inside the virtual enterprise. As the virtual enterprise achieves increased velocity through agile business development processes, the security and compliance offices must be ready to align with product teams. Security Offices lacking the ability to correctly classify and categorize the data within the XaaS will be seen as an obstruction to the business rather than an enabler. DevOps teams lacking the DevSecOps mentality will be unable to operationalize the organization’s governance, retention, and compliance needs. In turn, with malware scanning of the hosted data sources, CMS may unwittingly become its own enemy. A Software Solution for a Complex Problem The promises of “Anything as a Service” (XaaS) transform the way businesses solve complex problems with software solutions. Legacy backup and compliance solutions lack the transformational features required for today’s needs. Current generation solutions (native) miss critical aspects of the nature of the cloud and how this translates to corporate governance and compliance. None of the solutions take the unique approach of Elastio; where data protection is shifted left, the risk is reduced closer to zero, and the detection, identification, and eradication of malware is shifted to Day -N. Elastio and Atlassian Confluence: A User Case Consider our use case for Atlassian Confluence. Confluence is a popular Content Management System for product and project management. Using our example, we found a 400-user SaaS instance of Confluence had grown to over 80GB in size in 6 months. Further, we discovered that the overall size of the CMS was increasing by approximately 2% per day. Before using Elastio, a single data protection administrator was responsible for logging in and clicking on a button to backup Confluence. This admin was then responsible for downloading and archiving this 80GB so that it was available to the rest of the organization. We needed a better solution, so we started with code from Atlassian Labs for automation. We could automate the backup with the Atlassian Labs code as a base, but we lacked adequate data protection. Using Elastio, we could stream the application data directly to an Elastio vault where it is encrypted, deduplicated, and scanned for malware. Using a short-lived container in Amazon ECS, we integrated the Elastio API into a scheduled job and automated the process for the business. The entire proof of concept code can be downloaded here:https://github.com/elastio/contrib/tree/master/atlassian_backup-1.0.0 About Elastio Elastio detects and precisely identifies ransomware in your data and assures rapid post-attack recovery. Our data resilience platform protects against cyber attacks when traditional cloud security measures fail. Elastio’s agentless deep file inspection continuously monitors business-critical data to identify threats and enable quick response to compromises and infected files. Elastio provides best-in-class application protection and recovery and delivers immediate time-to-value. vchokshi