New companies with immature systems, old companies hiring young developers doing side stuff off in their own world, bad default configurations etc Most importa

New companies with immature systems, old companies hiring young developers doing side stuff off in their own world, bad default configurations etc Most importantly there's a large amount of highly incentivized people probing constantly at mass scale. These days it's very easy to scan the internet (github, IPs, domains, etc) for information and "bad S3 configuration" detection is just a script anyone can use. No advanced programming skills required.