A catalog of real-world cloud security incidents, parsed, and mapped to the MITRE ATT&CK framework. What follows is the shape of that attack surface — a ranking of the techniques attackers actually use, and the kill-chain stages they pass through to get there.