Only 40% of Organizations Call Their Cloud Security Program Mature, Even as 93% Already Run Production Workloads in the Cloud, New SANS Institute Survey Finds
Bethesda, MD, Oct. 21, 2026 (GLOBE NEWSWIRE) -- The question of whether to run production workloads in the cloud is effectively settled. Ninety-three percent of respondents already do, and 65% run with more than one provider. Today, SANS Institute released the SANS 2026 Cloud Security Survey Insights authored by Serge Borso, SANS Principal Instructor, and this year's data shows the security practice underneath that adoption has not scaled at the same rate.
With cloud adoption now near universal, this year’s research focuses on measuring security maturity rather than adoption, and the data shows a gap between the two. Only 40% of respondents call their cloud security strategy advanced or optimized, even though 51% run enterprise-scale or hyperscale environments and 73% already have a dedicated cloud security team or role. The largest group, 45%, has a defined strategy that is only partially implemented across their cloud environments.
Partial coverage is where incidents start. Misconfiguration is the leading cause of critical cloud incidents at 45%, close to double credential theft at 22%. And the fixes run long with close to half of organizations (49%) needing more than 24 hours to close a known critical gap.
"Misconfiguration is not an exotic attack class. It is a known gap sitting in an account somebody already owns," said Serge Borso, SANS Principal Instructor. "What makes it persist is not the attacker. It is the distance between finding the gap and fixing it, across too many consoles with nobody clearly owning the result. That is why consolidation and enforcement matter more right now than implementing yet another detection tool. The industry has finished deciding to move to the cloud and is now paying for how fast it did.”
Additional key findings from the survey include:
- Zero trust on paper but not yet in practice: 69% of organizations have deployed Zero Trust Network Access, but traditional VPN is still running at nearly the same rate (65%). Forty-five percent still verify trust primarily at the point of entry, a single login check rather than continuous verification.
- AI's role is augmentative, not autonomous: 56% describe AI as assisting with tasks like summarization and prioritization rather than acting on its own. Fifteen percent have operationalized it further and 4% report fully autonomous action, while 25% say AI has no role yet beyond evaluation.
- The machine identity visibility gap: 33% name knowing which identities exist as their top machine identity challenge, 32% name over-privileged access, 18% say credential rotation, and 17% say governance.
- Investment is pointed at the tool stack teams already have: Over the next 18 months, 62% prioritize investment in alert correlation across the full attack surface, 55% in simplified vendor management, 51% in cloud infrastructure entitlement management, and 44% in AI-driven threat hunting.
- Budgets are up and consolidation is uneven: 70% of organizations are spending more on cloud security than a year ago, 28% calling it significant investment and 42% incremental growth, while 7% report cuts. 21% run a single consolidated CNAPP platform, 31% still maintain separate point solutions across CSPM, CWPP, and CIEM, and 23% are actively evaluating a move to consolidate.
- Enforcement splits evenly: 39% run mandatory, automated gates that block noncompliant infrastructure code before deployment. An equal 39% rely only on advisory scanning that flags issues without blocking them.
The survey collected responses from more than 400 IT and security professionals working for organizations with operations in the United States, Europe, Asia, the Middle East, Canada, and Latin America. More than half (55%) of respondents hold security architect, security manager or director, security administrator or analyst, or IT manager or director roles.
The full SANS 2026 Cloud Security Survey Insights is free to download at sans.org/white-papers/sans-2026-cloud-security-survey-insights. Serge Borso will present an accompanying webcast, SANS 2026 Cloud Security Survey Insights: Navigating the Evolving Landscape of Threats, Tools, and Priorities, on Wednesday, October 21st at 10:30 a.m. ET and a recording will be available after. Sign up for the webcast or view the recording at sans.org/webcasts/sans-2026-cloud-security-survey-insights-threats-tools-priorities.
About SANS
The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cybersecurity training and certification to professionals in government and commercial institutions worldwide. Renowned SANS instructors teach more than 85 courses at in-person and virtual cybersecurity events and OnDemand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 50 hands-on technical certifications in cybersecurity. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's and bachelor's degrees, graduate certificates, and an undergraduate certificate in cybersecurity. SANS also delivers a wide variety of free resources to the InfoSec community, including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system, the Internet Storm Center. At the heart of SANS are the many security practitioners representing varied global organizations, from corporations to universities, working together to support and educate the global information security community.
Jenn Elston SANS Institute 301-654-7267 press@sans.org
© Copyright Globe Newswire, Inc. All rights reserved. The information contained in this news report may not be published, broadcast or otherwise distributed without the prior written authority of Globe Newswire, Inc.
