Closing the cloud security gap

Executive summary

The rise of artificial intelligence and cloud computing creates a perfect storm for cybersecurity. 

Cloud infrastructure has expanded the attack surface far more quickly than companies can adapt their security systems. AI-driven attacks take advantage of that vulnerability, as criminals use more sophisticated methods to steal credentials and access data before security teams notice.

That leaves many leaders believing they must choose to either slow down adoption of both cloud and important new technologies or accept the growing risk of AI-enabled cyberattacks. 

The evidence suggests that this is a false dichotomy. With the right cloud infrastructure and security system, organizations can adapt to emerging threats and gain the benefits of innovation while improving their security posture.

How cloud adoption changed cybersecurity

Traditional systems were built around local networks, meaning access was concentrated around a small number of entry points. Employees would connect directly to access tools and information; remote users could use a VPN that placed them inside the system. This created a clear security perimeter, with a central firewall that protected everything within the network. 

This made digital transformation tougher, slower, and more capital-intensive up front. Building on-premises systems was expensive; introducing new software might take weeks, rather than hours.

Cloud computing removed those restrictions, but it also removed that single concentrated entry point.

The cloud made firewall-based security one part of a more complex, widely dispersed system that used identity verification to keep outsiders from accessing the system. Users could access the system without a direct network connection; this made it simpler, faster, and cheaper to expand the digital ecosystem. But it also created security vulnerabilities that many organizations have yet to fully address.

Cybercriminals no longer need to breach the firewall; they can simply steal credentials from employees and access the system from anywhere. These attacks are challenging in several ways:
 

Cloud environments run on automation, with service accounts, API keys, CI/CD pipelines, containers, and now AI agents all authenticating to one another constantly. These non-human identities typically outnumber human ones by a wide margin, often hold standing permissions, and are rarely monitored as closely as employee accounts. 

Each is a potential entry point, and this category grows on its own as the environment scales, meaning the attack surface expands even when the organization is not consciously adding tools.

This shift has made cloud networks ripe targets for cybercrime. 2025 saw a 160% increase in credential theft, along with a 37% increase in cloud-focused attacks. In fact, 35% of cloud incidents involved valid account abuse. But just as organizations have become more aware of these threats, the scale and sophistication of attacks have been augmented by emerging technologies.

How AI augments cloud security threats

77% of organizations say AI has expanded their attack surface over the last 12 months. The problem isn’t just that networks now have more apps and potential entry points; “shadow AI,” where employees use unauthorized platforms at work, accounts for nearly half of all generative AI use, creating a clear vulnerability for organizations.

Three-quarters of leaders expect the security risks of AI to increase as they use the technology more. And those risks are augmented by the fact that attackers are also rapidly adopting the technology:

Faster, more dynamic breaches

AI makes system infiltration faster and more dynamic. Adversaries no longer need to be “at the keyboard” during an attack; instead, they can automate data exfiltration and run multiple attacks simultaneously.

Breakout speed, which measures how quickly an adversary starts navigating the network after initial entry, has increased substantially. The average breakout now takes 29 minutes, with the very fastest taking 27 seconds. That radically reduces the period during which security teams can identify, isolate, and mitigate attacks.

Cheaper, more effective attacks

AI has increased the volume and sophistication of credential and identity theft. Phishing attacks doubled between 2024 and 2025, with generative AI allowing criminals to develop images and text that are hard to identify as scams. Poor-quality visuals or awkward language were once clear giveaways; now, attackers can create near-flawless designs, translate foreign languages, and localize messages.

This can be achieved faster and at a lower cost, allowing attackers to deploy large-scale phishing campaigns with relative ease. Novel techniques, such as using AI to generate legitimate-seeming personas for insider attacks, will likely grow in prominence over the coming years.

The cost of weak cloud security: why improving security posture is a business priority

Cyberattacks and data breaches always have significant repercussions, but the costs associated with security failures are higher within the cloud. Complex digital environments mean attacks are harder to contain and can spread more quickly, leaving security teams scrambling to mitigate the damage.

Breaches involving data stored across multiple environments take 59 days longer to identify and contain than on-premises incidents; that leads to an average per-breach cost of over $1 million more. But the potential impact on digitization initiatives is potentially even more damaging.

How cloud security impacts innovation

Cloud security vulnerabilities threaten to hold back businesses at the exact moment they need to be most technologically adaptable. Rapid AI adoption is considered an existential necessity, with 53% of businesses expecting the technology to transform business models in their industry by 2030. That puts heavy pressure on leaders: Nearly three-quarters of CEOs expect to lose their jobs within two years if they fail to deliver AI-driven business gains.

Yet nearly three-quarters of organizations have been forced to delay or slow application deployments in the past 12 months due to security concerns. This helps explain why 62% of organizations expect cloud security budgets to grow over the next 12 months: companies simply cannot afford to be held back by security risks when the future viability of their business is at stake.

The question is where that budget will be best spent, and what a truly secure cloud infrastructure looks like.

The cloud security gap: why organizations struggle to handle emerging threats

The race to achieve full digital transformation led many organizations to adopt cloud at breakneck speed. Infrastructure was built to achieve scale, not necessarily to achieve cost-effectiveness or optimize security. 

This has created a gap between network sophistication and security preparedness. Organizations are often able to scale complex digital workflows and adopt innovative new tools; they just don’t have the in-house skills or strategy to properly secure them. 59% of leaders still rate their cloud security maturity as initial or developing, and just 39% had a mature, well-defined cloud-native security strategy.

That gap creates three problems: 

Lack of visibility

Given the growing speed and sophistication of attacks, organizations must be able to monitor activity in real time. Suspicious behavior must be flagged instantly; adversaries must be tracked across a large, complex network. Yet most cloud setups are not equipped to achieve that, especially as AI makes attacks more frequent and effective.

Roughly 80% of organizations say their cloud infrastructure features blind spots, while 66% lack strong confidence in their ability to detect and respond to cloud threats in real time. Once an adversary enters the network, most security teams struggle to contain them.

Security tool fragmentation

Many organizations have strong but incomplete security coverage. Networks are vast and complex; security tool stacks are large and fragmented. The average organization runs 83 different security tools from 29 different vendors, which often creates gaps that can be difficult to identify or fix without extensive integration challenges.

For example, zero trust has emerged as a crucial defense for cloud-based systems. Multi-factor authentication (MFA) systems help mitigate credential theft, as attackers require two separate entry points to gain access to the system. Yet 58% of organizations say their zero-trust solution covers less than half of their business environment.

Limited cloud security skills

Many organizations are still adapting to the fact that cloud security requires specialized skills, creating a major talent gap. Cloud security was cited as the second most urgently required skill in a recent cybersecurity workforce survey. And the problem isn’t only felt within cybersecurity; 30% of hiring managers identify cloud security as a top three deficit in their organizations.

Organizations are left with cloud infrastructure that needs a security overhaul but lack the skills required to fix it. But the solution might not be to fix the existing infrastructure, but to replace it with one built for the future of cloud security.

Three urgent ways to improve cloud security

1. Built-in zero trust

The shift from breaking in to logging in makes identity the control that matters most, yet zero trust is exactly what most organizations struggle to extend across their environment. 

The OVHcloud® Identity, Security and Operations suite provides that control natively. Identity and Access Management:

• Applies a zero-trust policy model with granular, least-privilege permissions
• Connects to the identity provider an organization already uses, such as Okta®, Microsoft Entra ID®, or Google Workspace®
• Governs machine identities through token-based authentication, addressing the service accounts and API keys that now outnumber human users

Secret Manager gives teams a controlled place to store credentials, keys, and tokens rather than leaving them hardcoded where they can leak, and Key Management Service keeps encryption keys under the customer's control. 

Because these work together through one interface, a security team does not have to stitch identity, secrets, and encryption across separate products, which eases both the fragmentation and the skills pressures identified earlier.

2. Unified cloud infrastructure

Some organizations respond to growing cloud costs and attack surface expansion by repatriating their infrastructure. But the real problem, though, is not the scale of cloud networks, but their fragmentation.

OVHcloud offers four infrastructure lines: bare metal, hosted private cloud, public cloud, and web cloud. These interoperate on open standards such as OpenStack® and Kubernetes® and connect through the vRack private network and OVHcloud Connect into one private network spanning public, private, and on-premises resources. 

That reduces the seams between environments where attackers move laterally, placing the estate under one access model and one control panel. The platform is built on open standards with reversibility in mind, meaning that consolidation does not lead to costly vendor lock-in.

3. Full visibility, flexibility, and control

Real-time visibility is the direct answer to attacks that look like normal activity, and it is the capability organizations most often lack. 

OVHcloud Logs Data Platform collects application, server, and security logs and streams them in real time, with alerting and support for the tooling teams already use, such as Grafana® and the ELK stack. Identity actions, key usage, and secret access all flow into that single audit stream, so behavior that signature-based defenses miss becomes visible in one place for a security team or SIEM to act on.

Control extends to where data sits: organizations choose the region their data and keys reside in, backed by recognized certifications. Predictable pricing without heavy egress charges means centralizing telemetry is not penalized. 

The result is jurisdictional control over data and a clear sight of who is doing what across the environment.

About OVHcloud

OVHcloud US is a subsidiary of OVHcloud, a global cloud leader and Europe’s top cloud provider, operating over 500,000 servers across 46 data centers on four continents to serve 1.6 million customers in over 140 countries. As a pioneer in trusted and sustainable cloud solutions with an excellent price-performance ratio, OVHcloud has spent over 20 years leveraging an integrated model that ensures total control of its value chain — from server design and data center construction to the orchestration of its fiber-optic network. This unique approach allows OVHcloud to independently meet all customer needs while providing the benefits of an environmentally conscious model, characterized by resource efficiency and an industry-leading carbon footprint. OVHcloud offers latest-generation solutions that combine high performance, predictable pricing, and data residency to support scalable growth.

OVHcloud® is a registered trademark of OVH SAS. Okta® is a registered trademark of Okta, Inc. Microsoft Entra ID® is a trademark of Microsoft Corporation. Google Workspace® is a trademark of Google LLC. OpenStack® is a registered trademark of OpenStack Foundation. Kubernetes® is a registered trademark of The Linux Foundation. Grafana® is a registered trademark of Raintank, Inc.