Report: 4 in 5 companies have experienced a cloud security incident

New research from cybersecurity company, Venafi, found that 81% of companies report that they have suffered a security incident in the cloud over the last year. And almost half (45%) report that their organization experienced at least four incidents.

The research looked to highlight the increased operational risk caused by companies migrating more of their applications to the cloud due to the complexity of cloud-native environments.

In fact, Venafi also found that companies currently host 41% of their applications on the cloud. That percentage is expected to rise to 57% throughout the next 18 months. As it rises, the need for robust cloud security will rise too.

With the complexity created by the cloud, machine identities have become a rich hunting ground for threat actors targeting the cloud. Every container — including Kubernetes cluster and microservices — needs an authenticated machine identity to communicate securely, such as a TLS certificate. Security and operational risks increase dramatically if one is compromised or misconfigured.

Venafi’s research also revealed that there is no clear industry standard for which the internal team is currently responsible for securing the cloud. Most commonly, this falls under the remit of enterprise security teams (25%), followed by operations teams responsible for cloud infrastructure (23%), a collaborative effort shared between multiple teams (22%), developers writing cloud applications (16%) and DevSecOps teams (10%). 

There is also not a clear consensus among security decision-makers about who should be responsible for securing the cloud. Cloud infrastructure operations teams and enterprise security teams (both 24%) are among the most popular, followed by sharing responsibility across multiple teams (22%), developers writing cloud applications (16%) and DevSecOps teams (14%).

New approaches to security must make use of a control plane to embed machine identity management into developer workloads, allowing teams to protect the business without slowing production.

For its research, Venafi polled 1,101 security decision-makers at companies with over 1,000 employees. Twenty-four percent of those surveyed were at companies with more than 10,000 employees.

Read the full report from Venafi.