--- url: "https://www.xcademia.com/news/spycloud-uses-aws-to-help-organizations-remediate-exposed-credentials-faster" title: SpyCloud Uses AWS to Help Organizations Remediate Exposed Credentials Faster description: "Learn how SpyCloud uses AWS to identify exposed credentials, session cookies, and API keys, helping security teams investigate and remediate identity risks." publishedAt: "2026-10-17T09:29:52.992+00:00" updatedAt: "2026-10-18T01:03:11.882186+00:00" type: news category: cybersecurity source_name: AWS Marketplace Blog source_url: "https://aws.amazon.com/blogs/awsmarketplace/shorten-the-time-from-credential-exposure-to-remediation-with-spycloud/" tags: - "#Cybersecurity" - "#IdentitySecurity" - "#CredentialExposure" - "#Infostealer" - "#ThreatIntelligence" - "#AWSMarketplace" - "#CloudSecurity" - "#IncidentResponse" --- # SpyCloud Uses AWS to Help Organizations Remediate Exposed Credentials Faster > SpyCloud's AWS-based identity intelligence pipeline helps security teams identify exposed passwords, session cookies, API keys, and other identity data harvested by infostealer malware, supporting faster credential resets and session revocation. Source: **AWS Marketplace Blog** · 17 October 2026 **S**pyCloud is using Amazon Web Services (AWS) to collect, process, and deliver identity intelligence that helps organizations identify compromised credentials before attackers can reuse them. In an AWS Marketplace Blog post published on October 16, 2026, AWS describes how SpyCloud operates its data pipeline to process information recovered from underground sources, including infostealer logs, phishing campaigns, third-party breaches, and credential lists. The approach addresses a security problem that extends beyond stolen passwords. Infostealer malware can collect session cookies, authentication tokens, browser autofill information, device identifiers, and API keys. Attackers may use this information to access corporate applications, cloud environments, and other systems. SpyCloud's service helps organizations identify exposed identity data and take remedial action, such as resetting affected passwords, invalidating compromised sessions, or rotating exposed API keys. Its products can also connect with existing identity providers, endpoint security tools, and security information and event management platforms. The company operates its collection and processing pipeline using AWS services, including Amazon Simple Queue Service (Amazon SQS), Amazon EC2, AWS Lambda, Amazon S3, and Amazon Relational Database Service (Amazon RDS). ## Why Credential Exposure Extends Beyond Passwords Traditional views of credential theft often focus on email addresses and passwords obtained from data breaches. Infostealer malware creates a broader risk because it can collect authentication material directly from infected devices. Malware families such as RedLine, Raccoon, and Vidar can gather information stored in browsers and other applications. Depending on the information available on a device, stolen data may include: - Corporate usernames and passwords - Session cookies and authentication tokens - Browser autofill data - Device identifiers and browser fingerprints - API keys and machine credentials Session cookies are particularly important because they can allow an attacker to reuse an existing authenticated session without completing a fresh login. In some circumstances, this can bypass the normal login flow, including a new multifactor authentication challenge. Exposed API keys present a different risk. If a key grants access to cloud services or development systems, an attacker may be able to use it without following the organization's usual interactive login process. SpyCloud's 2026 Identity Exposure Report, cited by AWS, identified **65.7 billion distinct identity records circulating underground**, representing a reported 23% increase from the previous year. The report also described growing exposure involving non-human identities across cloud infrastructure, payment platforms, developer ecosystems, and AI services. The same report found that 18.1 million API keys and tokens were recaptured during 2025. These figures are attributed to SpyCloud's research. They describe the company's reported findings and should not be interpreted as a count of unique compromised organizations or confirmed successful attacks. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792228778506-info-1--221-.webp) ## SpyCloud's Identity Intelligence Approach SpyCloud gathers exposed identity information from sources that include underground forums, infostealer logs, phishing kits, credential combination lists, and third-party breaches. Its products address different parts of the identity exposure problem: - **Workforce Threat Protection:** Monitors employee identities against information found in breach and malware data. - **Session Identity Protection:** Helps identify exposed session cookies so security teams can invalidate affected sessions and address potential session-based authentication bypass. - **Endpoint Threat Protection:** Helps identify devices associated with compromised information and can work alongside endpoint detection and response tools, including CrowdStrike Falcon, to support device isolation workflows. - **Supply Chain Threat Protection:** Monitors exposure involving vendor and other third-party identities. - **Cybercrime Investigations:** Provides threat intelligence teams with a search console and identity-resolution capabilities through IDLink. SpyCloud says its IDLink technology connects fragmented identity records across more than 135,000 breach sources. The company also reports that its internal benchmarks show IDLink can return up to eight times more records than exact-match searches alone. That figure is a company-reported benchmark, not a guarantee of results for every search or investigation. SpyCloud also reports tracking more than 105 infostealer malware families as of October 2026. Its data collection and parsing pipeline supports the processing of information from these and other sources into records that customers can search and use in security workflows. ## How the AWS Data Pipeline Processes Exposed Identity Data SpyCloud's publicly documented pipeline follows four broad stages: ingestion, parsing, storage, and serving. Each stage performs a distinct role in converting raw information into searchable identity intelligence. ### 1. Ingestion: Collecting data from multiple sources The process begins with information recaptured from sources such as infostealer logs, successful phishing campaigns, third-party breaches, and credential lists. Amazon SQS queues separate data collection from downstream processing. This design helps absorb incoming workloads when a large breach or other event creates a sudden increase in collected data. Decoupling these stages means incoming records can be queued for processing instead of requiring every downstream component to handle the same burst immediately. ### 2. Parsing: Normalizing inconsistent records Raw data does not arrive in a single standard format. Breach datasets may use different field structures, while infostealer families can produce different log formats. SpyCloud uses Amazon EC2 instances for heavier batch-processing workloads and AWS Lambda functions for event-driven transformations. The company also describes using large language model (LLM)-powered parsing to classify and validate identity attributes across inconsistent formats. This processing forms part of SpyCloud's AI Insights layer. According to the company, the pipeline operates across more than 65.7 billion identity artifacts. The use of LLM-powered parsing is intended to help interpret varied input structures. The source does not provide a detailed accuracy benchmark for this parsing process, so its performance should not be assumed to be uniform across all data formats. ### 3. Storage: Making parsed records available After parsing, records are stored in Amazon S3, which serves as the data lake, and Amazon RDS, which supports indexed lookups. SpyCloud states that its implementation encrypts stored data at rest using Advanced Encryption Standard 256-bit (AES-256) through AWS Key Management Service (AWS KMS). It also reports encrypting data in transit using TLS 1.2 or later. These are security measures described by SpyCloud for its implementation of the pipeline. They do not eliminate the need to assess access controls, operational practices, and other security responsibilities. ### 4. Serving: Delivering intelligence to security tools AWS Lambda powers the SpyCloud REST API, which allows security teams and connected applications to query exposed identity information. According to SpyCloud's documentation, queries can use identifiers such as email addresses, domains, IP addresses, session cookies, API keys, and device fingerprints. The company says its API is designed to return results in milliseconds. The same API can feed automated workflows through SpyCloud Connect, which delivers data to supported security information and event management (SIEM) platforms, security orchestration, automation, and response (SOAR) tools, and ticketing systems. The overall pipeline separates collection, transformation, storage, and retrieval. This architecture supports a service in which customers can query exposed identity data without operating SpyCloud's underlying collection infrastructure themselves. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792228849496-info-2--203-.webp) ## From Exposure Detection to Remediation Finding exposed information is only useful when an organization can connect it to an identity or system and take appropriate action. The AWS article describes a scenario in which infostealer malware infects an employee's personal laptop. The malware collects corporate credentials, an Okta session cookie, browser autofill information, and API keys stored in developer tools. SpyCloud's pipeline processes the exposed data, identifies the corporate email domain, and compares it with the customer's monitored identities. The subsequent response depends on the information exposed and the integrations available: 1. **Identify the affected identity.** Workforce Threat Protection can flag exposed corporate credentials associated with a monitored employee. 2. **Reset affected credentials.** For customers with supported Okta or Active Directory integrations, automated password-reset workflows may be triggered. 3. **Invalidate exposed sessions.** Session Identity Protection can surface a compromised session cookie so the security team can revoke the session. 4. **Rotate exposed API keys.** If developer or cloud credentials are found in exposed data, the security team can rotate them before they are used for unauthorized access. 5. **Investigate the affected device.** Endpoint Threat Protection can help identify compromised machines and work with compatible endpoint security tools on isolation workflows. These actions depend on the customer's configuration, integrations, and operational procedures. Discovering exposed information does not itself reset a password, invalidate a session, or rotate an API key unless the relevant workflow is configured and executed. The objective is to shorten the gap between learning that identity data has been exposed and taking action to reduce the chance of its misuse. ## Why Endpoint Protection May Not Be Enough Endpoint security remains an important part of an organization's defenses, but SpyCloud argues that it does not provide complete visibility into every credential later exposed through an infection. According to research cited in the AWS article, **66% of devices infected with malware had antivirus software or endpoint detection and response (EDR) installed at the time of infection**. This is a SpyCloud-reported finding. It should not be interpreted as evidence that endpoint security is ineffective overall. Instead, it illustrates the potential gap between detecting malware activity on a device and discovering that identity data from that device has subsequently appeared in underground sources. Identity exposure monitoring addresses a different stage of the problem. Endpoint controls focus on device activity and threats within their coverage, while exposure intelligence can reveal that credentials or session material are circulating beyond the original device. SpyCloud also cites its 2025 Identity Exposure Report for the claim that nearly 50% of corporate users had encountered infostealer malware on professional or personal devices. This figure is attributed to the company's research and is not a universal estimate for every workforce. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792228959520-info-3--189-.webp) ## Deployment, Pricing, and Operational Considerations SpyCloud is offered through AWS Marketplace as a software-as-a-service (SaaS) product. The company operates the core data pipeline in its own environment, so customers do not need to deploy the ingestion and processing infrastructure described in the article directly in their AWS accounts. Customers connect SpyCloud's intelligence to their existing security tools using its REST API, SpyCloud Connect, and supported integrations. The source lists options for Splunk, CrowdStrike, Okta, and Microsoft Sentinel. Organizations can begin by running SpyCloud's complimentary exposure check for their domain. They can then review the AWS Marketplace listing, contact SpyCloud about pricing, and assess the API documentation before deciding how to integrate the service. ### Cost model The source identifies the SpyCloud subscription as the main product cost. The subscription is billed through AWS Marketplace, with pricing based on the duration and terms of the agreement and the number of identities protected. The public listing describes a 12-month contract option. Organizations seeking volume-based or committed-term arrangements can request a private offer from SpyCloud. Additional AWS costs may arise from resources a customer operates in its own account to consume SpyCloud data, such as SIEM or SOAR infrastructure. These costs are separate from the SpyCloud subscription and depend on the customer's architecture and usage. The article does not provide a universal subscription price. Organizations should confirm current pricing, contractual terms, and applicable infrastructure costs before purchasing. ### Cleanup and cancellation Because the core SpyCloud service runs as SaaS in SpyCloud's environment, customers do not need to remove its core data pipeline from their own AWS accounts. They may need to remove AWS resources they created to consume the data, such as automation functions or log-ingestion pipelines. Customers who connected SpyCloud to other security tools or deployed Identity Guardians should contact SpyCloud support for assistance with removal. For a public 12-month contract, the source describes cancelling renewal through the product's ordering page in the AWS Marketplace console. Access continues until the current contract term ends. Customers should review their actual agreement and current Marketplace options before making changes. ## What This Means for Security Teams **Analysis:** SpyCloud's approach highlights a broader shift toward treating identity exposure as an ongoing security signal rather than waiting for an account takeover or suspicious login to reveal a problem. Credential theft can affect several types of authentication material at once. A password reset may address one exposed credential, but a stolen session cookie or API key may require a separate response. Organizations therefore need workflows that can identify the type of exposure and connect it to the correct remediation action. The AWS-based pipeline provides the data-processing foundation for SpyCloud's service, while integrations connect the resulting intelligence to customer security operations. For organizations evaluating this model, the key considerations include the identities being monitored, the coverage of relevant exposure sources, integration requirements, access permissions, and the team's ability to verify remediation. Exposure intelligence should complement strong identity controls, endpoint protection, multifactor authentication, least-privilege access, and appropriate credential rotation practices. It is not a substitute for those controls, nor does the discovery of exposed data guarantee that an attempted attack will be prevented. The most useful outcome is a clearer path from discovering compromised identity material to confirming that affected credentials, sessions, or keys have been addressed. ## Conclusion SpyCloud's AWS-based pipeline is designed to turn data recaptured from underground sources into searchable identity intelligence for security teams. Amazon SQS, EC2, Lambda, S3, and RDS support the collection, processing, storage, and delivery stages described in the article. By connecting exposed identity records with workforce, endpoint, and security operations tools, SpyCloud helps customers identify potential exposure and initiate relevant remediation workflows. For organizations facing risks from infostealer malware, the central issue extends beyond whether a password has been stolen. Session cookies, API keys, and other machine credentials can also create exposure. Identifying those records and acting on them quickly is an important part of a broader identity security strategy. ## Original source https://aws.amazon.com/blogs/awsmarketplace/shorten-the-time-from-credential-exposure-to-remediation-with-spycloud/ ## Tags `#Cybersecurity` · `#IdentitySecurity` · `#CredentialExposure` · `#Infostealer` · `#ThreatIntelligence` · `#AWSMarketplace` · `#CloudSecurity` · `#IncidentResponse` --- ## About this content This Markdown news article is the citation-grade twin of [SpyCloud Uses AWS to Help Organizations Remediate Exposed Credentials Faster](https://www.xcademia.com/news/spycloud-uses-aws-to-help-organizations-remediate-exposed-credentials-faster). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/spycloud-uses-aws-to-help-organizations-remediate-exposed-credentials-faster - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt