80% of Organizations Have Experienced a Severe Cloud Security Incident in Past Year
October 20, 2022

Four-fifths (80%) of organizations have experienced at least one severe cloud security incident in the past year (such as data breaches, data leaks, and intrusions into their environment), according to the State of Cloud Security Report from Snyk.


The report also found:

■ 41% of respondents say cloud native services increase complexity, further complicating their security efforts.

■ Nearly half (49%) of organizations find deployment is faster as a result of improved cloud security.

"This new research should serve as a wake-up call that our collective cloud security risk is universal and will only continue to grow if we double down on outdated approaches and legacy tools," said Josh Stella, Vice President, Chief Architect, Snyk. "The outlook is not entirely dire, however, as the data also clearly reveals that shifting cloud security left and embracing DevSecOps collaboration can allow global organizations to continue their current pace of innovation more securely."

80% Experienced a Severe Cloud Security Incident, Startups and Public Sector Currently Most Impacted

Cloud customers representing organizations of all sizes and industry sectors noted they were impacted by major cloud security events over the last 12 months, with startups (89%) and public sector organizations (88%) most impacted.

On the other hand, enterprise companies fared better (most likely due to greater investment), while small and mid-sized businesses (SMBs) reported making out the best (probably as result of a smaller cloud footprint and less infrastructure complexity).

Respondents specified data breaches, data leaks, and intrusions into their environment were among the most severe incidents they had knowledge of. All of these unquestionably carry a high cost to global businesses, including but not limited to: fines for failed audits and compliance violations, cryptomining on the customer's cloud bill, and loss of productivity due to system downtime.

Tellingly, respondents also indicated this universal risk is likely to grow in the near term. To this end, respondents admitted:

■ A quarter (25%) worry they've recently suffered a cloud data breach but are unaware.

■ The majority (58%) of both security pros and developers believe that the risk of a cloud data breach at their organization will only increase over the next year.

Cloud Native Approach: 41% Cite Additional Complexity as a Trade-Off

While cloud-native application development undoubtedly allows modern developers to move faster to produce more, at the same time, new challenges and complexities have emerged as the overall attack surface has expanded and the clear delineation of security responsibilities has blurred. 

Ultimately, many of today's cloud security failures result from a lack of effective cross-team collaboration and team training. When different teams use different tools or policy frameworks, reconciling work across those teams and ensuring consistent enforcement can be challenging.

Moreover, insufficient tooling that produces false positives often leads to alert fatigue within security teams, contributing to human error when identifying the critical issues needed to be prioritized and addressed.

Further, consider:

■ 77% of organizations cite problems with poor training and collaboration as a major challenge.

■ 45% of companies cite demand for engineering resources as the biggest impact of inefficient cloud security.

Strategic Business Results Recognized With Improved Cloud Security: Half See Resulting Faster Deployment

When organizations improve their cloud security, they experience benefits reaching beyond incident mitigation alone.

By fully embracing the cloud to build new applications, teams ultimately can no longer rely on – and therefore let go of – the traditional security approaches and technologies that were designed for legacy environments. Given the realities of cloud-native development and the numerous internal stakeholders involved, businesses that champion and adopt this paradigm shift reap the benefits of increased team collaboration, facilitating enhanced developer productivity and faster secure innovation.

To this end, respondents asserted:

■ Infrastructure-as-code (IaC) security delivers a 70% median reduction in cloud misconfigurations.

■ Close to half (48%) said their security team is able to do more with the resources they have when cloud security is improved.

■ 44% said that security improvements have led to better collaboration among teams.

Share this

Industry News

December 01, 2022

Salesforce introduced a new Automation Everywhere Bundle to accelerate end-to-end workflow orchestration, automate across any system, and embed data and AI-driven workflows anywhere.

December 01, 2022

Weaveworks announced that Flux, the original GitOps project, has graduated in the Cloud Native Computing Foundation (CNCF®).

December 01, 2022

Tigera announced enhancements to its cluster mesh capabilities for managing multi-cluster environments with Calico.

December 01, 2022

CloudBees achieved the Amazon Web Service (AWS) Service Ready Program for Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances.

November 30, 2022

GitLab announced the limited availability of GitLab Dedicated, a new way to use GitLab - as a single-tenant software as a service (SaaS) solution.

November 30, 2022

Red Hat announced an expansion of its open solutions publicly available in AWS Marketplace.

November 30, 2022

Sisense announced the availability of the Sisense CI/CD Git integration module.

November 29, 2022

Codenotary announced TrueSBOM for Serverless, a self-updating Software Bill of Materials (SBOM) for applications running on AWS Lamda, Google Cloud Functions and Microsoft Azure Functions that is made possible by simply adding one line to the application source code.

November 29, 2022

Code Intelligence announced its open-source Command-Line Interface (CLI) tool, CI Fuzz CLI, now allows Java developers to easily incorporate fuzz testing into their existing JUnit setup in order to find functional bugs and security vulnerabilities at scale.

November 29, 2022

Parasoft announced the 2022.2 release of Parasoft C/C++test with support for MISRA C:2012 Amendment 3 and a draft version of MISRA C++ 202x.

November 28, 2022

Kasm Technologies announced the release of Kasm Workspaces v1.12, providing major enhancements to its portfolio of digital workspaces delivering Desktop as a Service (DaaS), Virtualized Desktop Infrastructure (VDI), Remote Browser Isolation (RBI), Open-Source Intelligence Collection (OSINT), Training/Sandboxes, and Containerized Application Streaming (CAS).

November 28, 2022

Cloud4C has achieved Amazon Web Services (AWS) DevOps Competency status.

November 28, 2022

Simplilearn has acquired Fullstack Academy, for an all-cash transaction.

November 22, 2022

Red Hat introduced Red Hat Enterprise Linux 9.1and Red Hat Enterprise Linux 8.7.

November 22, 2022

Armory announced its new cloud-based solution called Continuous Deployment-as-a-Service, now available on the AWS Marketplace.