Why security is becoming the central cloud question
The cloud brings scalability, cost reduction and speed of deployment. But as organisations move their data to cloud storage, security becomes a critical concern that must be tackled head-on.
Cloud providers offer a broad range of services without always giving security the attention it requires. They retain access to sensitive data, financial records, personnel information, intellectual property, research data, and customer activity logs present an additional vulnerability to attackers.
This responsibility does not stop with the provider: the shared responsibility model leaves each organisation in charge of securing its configurations, identities and data, however robust the underlying infrastructure may be. It is this poorly understood grey zone that accounts for most incidents observed in production.
The threat landscape has also hardened under the effect of artificial intelligence: a majority of analysts now find AI-generated phishing attacks harder to detect, and global damages from multi-stage extortion ransomware are expected to reach $74 billion in 2026. Above all, 70% of cloud compromises now originate from hijacked identities rather than software flaws, which puts identity and access management back at the centre of any cloud security strategy.
The main cloud security challenges
Data breaches, compliance and privileged access
The first challenge is data breaches driven by misconfigurations: cloud environments widen the attack surface and expose organisations to phishing, account hacking, ransomware, malware and distributed denial-of-service attacks. Human error in managing complex configurations often goes unnoticed until the damage is done. The second challenge is compliance: organisations must track and document data usage and traffic flows to meet frameworks such as GDPR, HIPAA or, in Europe, the NIS2 directive, which now extends security obligations to a much broader range of companies. The third challenge is securing privileged access: a privileged identity can be escalated to admin access, opening the way for attackers to reach critical systems.
Loss of visibility and careless migration
The fourth challenge is loss of visibility and control: distributing data and workloads across cloud infrastructure makes monitoring and troubleshooting harder, especially as the shared responsibility model leaves part of the infrastructure in the provider's hands. The fifth challenge is careless cloud migration: without prior understanding of the threats or a secure architecture, businesses expose themselves to serious downtime. These five challenges are not independent: poor visibility almost always worsens the consequences of a data breach or privilege misuse, because it delays detection and incident response. In multicloud environments, this cumulative effect is even more pronounced: every additional vendor brings its own console, its own log formats and its own naming conventions, fragmenting the overall view at the exact moment it is needed most.
Best practices to secure the cloud
CASB, multifactor authentication and the shift to CNAPP
The first practice is to deploy CASBs (Cloud Access Security Brokers): these observability tools sit between users and cloud applications, monitor activity, enforce security policies and detect unauthorised access before exploitation. By 2026, these CASB building blocks increasingly sit inside CNAPP (Cloud-Native Application Protection Platform) suites, which unify cloud posture management (CSPM), workload protection (CWPP) and identity and entitlement management (CIEM) on a single risk graph: 80% of enterprises now consolidate their cloud-native security tooling to three vendors or fewer, down from around ten in 2022. The second practice is multifactor authentication (MFA), which requires at least two pieces of evidence, a physical object such as a token or card, or a knowledge item such as a password, and pairs usefully with BYOD policies. The most mature organisations now favour phishing-resistant factors, such as FIDO2 physical keys or passkeys, over SMS-delivered codes, which remain more vulnerable to interception and SIM-swapping.
Privileged access management and micro-segmentation
The third practice is privileged access management (PAM), which controls and monitors privileged access by storing credentials in secure vaults, within a Zero Trust logic where no access is trusted by default. The fourth is micro-segmentation: dividing the network into segments with separate security controls, using virtual firewalls, to contain a compromise to the affected area.
Penetration testing and encryption
The fifth practice combines vulnerability testing and penetration testing: unlike a one-off audit, penetration testing actively seeks to exploit weaknesses, notably in the APIs that make systems communicate. The sixth is encryption, which protects data at rest and in motion and should ideally cover its in-memory processing by applications, down to email clients and mobile devices. Encryption itself is entering a transition phase: NIST has finalised its post-quantum cryptography standards (ML-KEM for key exchange, ML-DSA and SLH-DSA for signatures), and the most exposed organisations are starting to plan their migration to guard against so-called "harvest now, decrypt later" attacks, where data encrypted today is intercepted and stored for future decryption once quantum computers become available.
Non-human identities: the new blind spot in cloud security
The proliferation of machine identities and AI agents
Service accounts, API keys, serverless functions and now autonomous AI agents form a population of non-human identities that already far outnumbers human users in most cloud environments. These identities authenticate, act and propagate at a speed that access review processes designed for humans cannot keep up with: a poorly scoped AI agent can, within minutes, invoke dozens of services with rights that no quarterly review would have caught in time.
Vaulting, secret rotation and least privilege
Addressing this risk means distinguishing non-human identities that use vaulted, managed credentials from those that keep static, unmonitored credentials, then rolling out automatic secret rotation, strict least-privilege entitlements and systematic expiry of temporary access. This discipline becomes all the more critical as identity-based attacks remain the dominant vector, with non-human identities accounting for a growing share of compromised credentials. An up-to-date inventory of these identities, maintained automatically rather than manually, is an essential prerequisite: you cannot monitor what you have not catalogued, and AI agents multiply the number of identities created on the fly every day, without a centralised approval process.
What holds the approach together
None of these practices is enough on its own. MFA alone limits identity theft, but it is PAM that reduces the attack surface and prevents accidental privilege misuse; micro-segmentation only truly protects when encryption and penetration testing come with it.
Cloud security is therefore less a checklist of controls than an overall posture: understanding your threats before migrating, keeping visibility despite distributed workloads, and continuously verifying that your defences hold against attackers who never stop. This posture must also be reviewed regularly, since a control that was relevant at the time of migration can become insufficient a few quarters later, as the organisation adds new services, new vendors and new identities to its perimeter.
The real cost of a cloud breach
These efforts have a measurable return on investment. According to the IBM Cost of a Data Breach report, a breach spanning multiple environments costs an average of $5.05 million, against $4.18 million for a breach confined to the public cloud and $4.01 million on-premises: the more fragmented and poorly supervised the environments, the more expensive the incident is to contain and remediate.
How Adservio secures your cloud environments
At Adservio, we help businesses regain control of their cloud security: identifying potential risks, mapping human and non-human identities, then implementing a protection plan suited to their environment and compliance requirements.
Our conviction: a robust, resilient, scalable and highly available cloud environment is built with security as its guiding thread, not as a last-minute fix. We support your digital transformation projects, from defining your Zero Trust posture through to preparing your post-quantum migration, and transfer control to your teams so they operate these defences autonomously over time.
STAY POSTED
Get our next analyses and field notes straight to your inbox.
