Almost every organisation now runs production workloads in the cloud, but only 40% of them consider their cloud security strategy advanced or optimised, according to a new SANS survey.
The 2026 SANS Cloud Security Survey Insights draws on responses from 400 IT and security professionals. Of those, 93% run production workloads in the cloud. Nearly half (45%) describe their security strategy as only partially implemented, and 49% take more than 24 hours to address known critical security gaps.
Serge Borso, Principal Instructor at SANS, pointed to misconfiguration as the persistent weak spot. "Misconfiguration is not an exotic attack class. It is a known gap sitting in an account somebody already owns," he said. He added that the delay comes from the distance between finding a gap and fixing it, across too many consoles and without a clear owner, which is why consolidation and enforcement matter more right now than another detection tool.
David Brown, Solutions Director at AND Digital, linked the findings to data governance. AND Digital's own research found that 42% of organisations have no data governance structure in place. "As organisations move more of their operations into the cloud, maintaining visibility and control over increasingly complex environments becomes critical," Brown said. He expects AI to add further complexity, making governance, data quality and audit trails more important.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
