Weak passwords, missing two-factor authentication, and misconfigured sharing settings are the primary vectors for data breaches in cloud environments used by SMEs.