Every cloud provider should keep its customers' security audit logs for twelve months, free, by default. Picture why. A responder opens the audit search on a breached tenant, scrolls back for the intruder's first sign-in and hits the end of the window. Nothing before it is hidden; it was deleted on schedule. Short default audit log retention does that every day, and the objection to fixing it, storage cost, collapses once you price the storage.
Key Takeaways: Twelve months of free audit logs should be every cloud provider's default, because most free windows end before the average breach is found.
- Microsoft 365 Standard keeps 180 days, AWS event history 90; average detection takes 183 days.
- PCI DSS already requires a year of log history from card handlers.
- At AWS's S3 rate, stretching 2 GB a day from 90 to 365 days adds $12.65 a month.
- Find your oldest audit event this week; under a year means export.
Why should audit log retention be a full year?
Because the average breach is noticed about six months after it starts, a free window shorter than a year deletes the attacker's first moves before anyone goes looking for them.
IBM's Cost of a Data Breach Report 2026, as summarised by Secureframe, puts the average time to identify a breach at 183 days. Free windows are shorter. Microsoft raised Purview Audit (Standard) retention to 180 days from October 2023; Premium keeps a year. AWS's CloudTrail event history shows 90 days of management events at no charge. On our arithmetic, an average breach is found three days after a Standard tenant's first entries expired, and 93 days after an AWS account's with no trail. The part you lose is the part showing how they got in.
Storm-0558 showed the cost. In mid-2023 the State Department caught Chinese intruders in its Microsoft 365 mail through MailItemsAccessed, a record The Hacker News reported was then typically Premium-only. Microsoft freed it after the fact. One breach fixed one vendor's tier and set no rule, the same gap as CISA's memory safety roadmap, a deadline nobody is bound by, while duties like the Cyber Resilience Act's 24-hour early warning assume the evidence still exists.
Four numbers settle whether a year is excessive, drawn from IBM's 2026 report via Secureframe, Google's observability pricing page (as of October 2026), Microsoft's 2023 expansion and our own division of AWS's window by IBM's detection time.
Breach Lifecycle, Spotted to Contained
247 days
Evidence must outlast this
Google's Price for 400 Days of Admin Logs
$0
A year is affordable
Audit Log Types Microsoft Made Free
30 logs
Standard tenants now see them
Share of an Average Intrusion AWS Keeps
49%
Derived: half the trail survives
The zero should embarrass everyone else. Google keeps admin and login audit records past the one-year mark for every project and bills nothing, so free year-long retention is plainly not commercially impossible.
If the free window closes before the average intruder is noticed, the logs showing how they got in were deleted before anyone looked.
The federal rule moved too. OMB memo M-26-14, dated 22 May 2026, rescinded M-21-31, whose 12 months of active storage plus 18 months cold gave way to six months searchable and a year retrievable, per the memo's own appendix. Even trimmed, the government kept a year (retrievable, granted, not searchable), which makes a one-year vendor default look modest.
How long do Microsoft 365, AWS and Google keep audit logs for free?
Microsoft 365 Standard keeps six months, AWS's event history keeps three, and Google keeps admin activity for just over a year, so only one of the big three already meets the rule argued here.
The table sets those windows beside the two rules that already demand a year. PCI DSS v4.0.1 requirement 10.5.1 requires 12 months of audit log history, the latest three immediately available, as Microsoft's PCI guidance quotes it. Find your row and compare the last column with your own detection time.
| Provider or rule | Free or required window | Against a 183-day breach |
|---|---|---|
| ⏱ Microsoft 365 | 180 days Standard, 1 year Premium | Standard misses the first 3 days |
| ⏱ AWS CloudTrail | 90 days, management events only | 93 days lost without a trail |
| ⏱ Google Cloud | 400 days for admin logs, free | Covered, with 217 days spare |
| ⚖️ PCI DSS | 12 months, 3 instantly searchable | Binding if you take cards |
| ⚖️ US federal | 6 months searchable, 12 retrievable | Expect a restore in week one |
Only Google clears the bar by default, and only for admin activity: Data Access logs keep 30 days, per Google's storage documentation. The grey area, in our opinion rather than any rule: logs needing a restore should not count as retained for the first three months of an incident.
If your provider lights fewer than seven squares, the average intruder's first moves are gone before anyone looks. Each square is a month of free or required history from the documents cited above; the dashed line is IBM's 2026 average detection time, plotted by us.
Worked example: an AWS account with no trail keeps the 90-day event window and writes about 2 GB of audit events a day. Assumptions: S3 Standard at $0.023 per GB-month, the US East first-50-TB rate listed in October 2026; storage only, no compression, no ingest or query fees. Reaching 365 days means 275 more days, so 550 GB more at steady state. 550 × $0.023 = $12.65 a month, about $152 a year, or roughly 2.5 cents per person monthly at a 500-person firm, to close a 93-day blind spot. Your version is one subtraction, detection time minus window, and it belongs in your next renewal.
Where does a one-year default still fall short?
It falls short wherever the expensive part is search rather than storage, wherever logs hold personal data that privacy law says to delete, and wherever an intruder stays hidden for longer than a year.
Storage is the cheap part. SIEM ingest and hot search are where bills grow, and a vendor default changes neither. We would write the rule the PCI way: a year kept, a quarter searchable.
Privacy cuts the other way. Audit records carry user names and IP addresses, so the GDPR's storage limitation principle means a provider must justify the year and lock it down. Voluntary fixes have a poor record, as with default passwords, which lasted until the UK made banning them law.
- Microsoft's longer retention follows each user's licence, so mixed tenants keep mixed windows.
- AWS event history skips data events such as S3 object reads; only a trail records them.
- Exports need deletion protection, such as S3 Object Lock, or an admin-level intruder can erase them.
- Auditors wanting immediate access may reject logs that need a restore.
Your window is too short if any of these is true
- Your oldest Purview audit result is under a year old.
- CloudTrail shows no trail or event data store.
- You take cards but cannot produce twelve months of logs.
- Nobody can say who could delete your exported logs.
Make the rule yours before a regulator makes it everyone's. This week, find the oldest event your audit tool returns; if it is under a year old, export to locked cold storage and write a free one-year retention default into your next cloud contract.
How we checked this
We read Microsoft's Purview Audit retention announcement (rollout from October 2023), OMB memo M-26-14 (22 May 2026) and AWS and Google documentation checked in October 2026. IBM's 2026 detection figures come via Secureframe's summary. The worked example assumes 2 GB of audit logs a day at the S3 Standard rate, storage only. No product was tested hands-on for this article. Last verified: 29 October 2026.
Edited by Sheftali, reviewed after publication. Spotted something out of date? Tell us and we will correct it.
No comments
Post a Comment