This report provides an overview of the most prevalent threats related to the use of cloud services by HR companies and recommendations to address the attack surface. 

Due to the need to process high volumes of sensitive data such as Personal Identifiable Information (PII) and payroll information, HR companies are particularly vulnerable to compromise of external infrastructure processing them.

Cloud customers need to take care of the security of configuration of service and provisioned resources, as the cloud service provider is usually only responsible for the security of the cloud infrastructure.

HR companies are in an especially vulnerable position when using cloud providers’ services due to the processing of highly sensitive and regulated data, as security provided by the cloud owner is limited to the security of the infrastructure itself.