Cloud Security Maturity Gap: Most Firms Are in the Cloud, but Few Have Mastered Protecting It

Cloud use is now close to universal, but security has not kept pace. The 2026 SANS Cloud Security Survey Insights report, based on responses from 400 IT and security professionals, found that 93% of organisations run production workloads in the cloud and 65% use more than one provider. Only 40% describe their cloud security strategy as advanced or optimised, and 45% say it is "intermediate", meaning a defined strategy is only partly implemented. SANS says this partial implementation leads to security incidents.

The gap exists even among well-resourced organisations. Some 73% of respondents have a dedicated cloud security team or role. Misconfiguration was the leading cause of critical cloud incidents at 45%, nearly double credential theft at 22%. Around half of organisations (49%) need more than 24 hours to close a known critical gap. SANS Principal Instructor Serge Borso said misconfiguration is "a known gap sitting in an account somebody already owns", and that the delay comes from fixing issues across too many consoles with no clear owner. He argued consolidation and enforcement matter more right now than adding another detection tool.

Spending is rising. Seventy per cent of organisations are spending more on cloud security than a year ago, with 28% reporting significant investment in new technology such as AI or Cloud-Native Application Protection Platforms (CNAPP), and 42% reporting incremental growth. Only 7% reported budget cuts.