80% of Organizations Have Experienced a Severe Cloud Security Incident in Past Year
October 20, 2022

Four-fifths (80%) of organizations have experienced at least one severe cloud security incident in the past year (such as data breaches, data leaks, and intrusions into their environment), according to the State of Cloud Security Report from Snyk.

The report also found:

■ 41% of respondents say cloud native services increase complexity, further complicating their security efforts.

■ Nearly half (49%) of organizations find deployment is faster as a result of improved cloud security.

"This new research should serve as a wake-up call that our collective cloud security risk is universal and will only continue to grow if we double down on outdated approaches and legacy tools," said Josh Stella, Vice President, Chief Architect, Snyk. "The outlook is not entirely dire, however, as the data also clearly reveals that shifting cloud security left and embracing DevSecOps collaboration can allow global organizations to continue their current pace of innovation more securely."

80% Experienced a Severe Cloud Security Incident, Startups and Public Sector Currently Most Impacted

Cloud customers representing organizations of all sizes and industry sectors noted they were impacted by major cloud security events over the last 12 months, with startups (89%) and public sector organizations (88%) most impacted.

On the other hand, enterprise companies fared better (most likely due to greater investment), while small and mid-sized businesses (SMBs) reported making out the best (probably as result of a smaller cloud footprint and less infrastructure complexity).

Respondents specified data breaches, data leaks, and intrusions into their environment were among the most severe incidents they had knowledge of. All of these unquestionably carry a high cost to global businesses, including but not limited to: fines for failed audits and compliance violations, cryptomining on the customer's cloud bill, and loss of productivity due to system downtime.

Tellingly, respondents also indicated this universal risk is likely to grow in the near term. To this end, respondents admitted:

■ A quarter (25%) worry they've recently suffered a cloud data breach but are unaware.

■ The majority (58%) of both security pros and developers believe that the risk of a cloud data breach at their organization will only increase over the next year.

Cloud Native Approach: 41% Cite Additional Complexity as a Trade-Off

While cloud-native application development undoubtedly allows modern developers to move faster to produce more, at the same time, new challenges and complexities have emerged as the overall attack surface has expanded and the clear delineation of security responsibilities has blurred. 

Ultimately, many of today's cloud security failures result from a lack of effective cross-team collaboration and team training. When different teams use different tools or policy frameworks, reconciling work across those teams and ensuring consistent enforcement can be challenging.

Moreover, insufficient tooling that produces false positives often leads to alert fatigue within security teams, contributing to human error when identifying the critical issues needed to be prioritized and addressed.

Further, consider:

■ 77% of organizations cite problems with poor training and collaboration as a major challenge.

■ 45% of companies cite demand for engineering resources as the biggest impact of inefficient cloud security.

Strategic Business Results Recognized With Improved Cloud Security: Half See Resulting Faster Deployment

When organizations improve their cloud security, they experience benefits reaching beyond incident mitigation alone.

By fully embracing the cloud to build new applications, teams ultimately can no longer rely on – and therefore let go of – the traditional security approaches and technologies that were designed for legacy environments. Given the realities of cloud-native development and the numerous internal stakeholders involved, businesses that champion and adopt this paradigm shift reap the benefits of increased team collaboration, facilitating enhanced developer productivity and faster secure innovation.

To this end, respondents asserted:

■ Infrastructure-as-code (IaC) security delivers a 70% median reduction in cloud misconfigurations.

■ Close to half (48%) said their security team is able to do more with the resources they have when cloud security is improved.

■ 44% said that security improvements have led to better collaboration among teams.

Share this

Industry News

June 01, 2023

Couchbase announced a broad range of enhancements to its Database-as-a-Service Couchbase Capella™.

June 01, 2023

Remote.It release of Docker Network Jumpbox to enable zero trust container access for Remote.It users.

June 01, 2023

Platformatic launched a suite of new enterprise-grade products that can be self-hosted on-prem, in a private cloud, or on Platformatic’s managed cloud service:

May 31, 2023

Parasoft announced the release of C/C++test 2023.1 with complete support of MISRA C 2023 and MISRA C 2012 with Amendment 4.

May 31, 2023

Rezilion announced the release of its new Smart Fix feature in the Rezilion platform, which offers critical guidance so users can understand the most strategic, not just the most recent, upgrade to fix vulnerable components.

May 31, 2023

Zesty has partnered with skyPurple Cloud, the public cloud operations specialists for enterprises.

With Zesty, skyPurple Cloud's customers have already reduced their average monthly EC2 Linux On-Demand costs by 44% on AWS.

May 30, 2023

Red Hat announced Red Hat Trusted Software Supply Chain, a solution that enhances resilience to software supply chain vulnerabilities.

May 30, 2023

Mirantis announced Lens Control Center, to enable large businesses to centrally manage Lens Pro deployments by standardizing configurations, consolidating billing, and enabling control over outbound network connections for greater security.

May 25, 2023

Red Hat announced new capabilities for Red Hat OpenShift AI.

May 25, 2023

Pipedrive announced the launch of Developer Hub, a centralized online app development platform for technology partners and developers.

May 25, 2023

Delinea announced the latest version of Cloud Suite, part of its Server PAM solution, which provides privileged access to and authorization for servers.

May 24, 2023

Red Hat announced Red Hat Service Interconnect, simplifying application connectivity and security across platforms, clusters and clouds.

May 24, 2023

Teleport announced Teleport 13, the latest version of its Teleport Access Platform to enhance security and reduce operational overhead for DevOps teams responsible for securing cloud infrastructure.

May 24, 2023

Kasten by Veeam announced the release of its new Kasten K10 V6.0 Kubernetes data protection platform.

May 23, 2023

Red Hat announced Red Hat Developer Hub, an enterprise-grade, unified and open portal designed to streamline the development process through a supported and opinionated framework.