Cloud security for decision-makers

Most organisations did not decide to move to the cloud. They accumulated it. A payroll service here, a file-sharing platform there, a marketing tool bought on someone’s card, and at some point the majority of the company’s data lives somewhere nobody has a complete list of. This guide covers what you are actually responsible for, what the current evidence says about where things go wrong, and the questions that reveal your real position.

The single most useful concept

Cloud providers operate on shared responsibility. They secure the things underneath your service, and you secure the things you put on top. Where the line sits depends on what you bought, but the layers most likely to cause an incident sit on your side no matter what you bought.

This matters because of a common and expensive assumption. Buying a service from a large, competent provider does genuinely remove a category of worry: their data centres, their hardware, their platform patching. It removes none of the worry about who in your organisation can reach the data, how the service was set up, or whether anyone would notice misuse.

When a well-known company suffers a cloud data breach, the provider’s infrastructure has almost never failed. Far more often a storage location was left open to the internet, an administrator account was reused or unprotected, or an integration granted access far beyond what it needed. All three are customer-side.

What the current evidence says

IBM’s 2026 Cost of a Data Breach study, based on 602 organisations breached between March 2025 and February 2026, puts the global average cost at US$4.99 million, a record and up 12 percent year on year. The United States average was US$11.5 million.

Two findings from it are worth a leader’s attention. The first is that identity and access management ranked second among all the factors that reduced breach costs, behind only a secure development approach. That is a reassuringly boring conclusion: controlling who can reach what remains the highest-value thing most organisations can improve.

The second concerns the newest layer of cloud spending. More than one in five breached organisations had an incident involving their own AI models or applications, up from around one in eight the previous year. Among that group, 92 percent were missing basic access controls such as role-based permissions and multi-factor authentication on those systems. IBM attributes the common causes not to the models themselves but to the surrounding plumbing, with compromised interfaces and connected applications and cloud misconfiguration each appearing in 27 percent of those cases.

Perhaps the most striking number for anyone responsible for procurement: tools adopted without approval featured in 43 percent of breached organisations, up from 20 percent a year earlier. That is not a technology problem. It is a purchasing and communication problem, and it is solved by making the approved route easier than the unapproved one.

Identity is the way in

The pattern across this year’s research is consistent enough to plan around. Cisco Talos recorded authentication abuse in 65 percent of its incident response engagements last quarter, up from 35 percent. Sophos found that 79 percent of ransomware attacks began with an identity-based approach.

In a cloud environment this matters more than it did on a company network, for a simple structural reason. There is no building to be inside. A cloud service cannot tell whether the person signing in is at their desk or on another continent, so the credential and the device are doing all the work that walls and badges used to do.

The practical consequence is that access decisions carry more weight than they used to. An administrator account without phishing-resistant sign-in is a bigger exposure in a cloud service than the equivalent account on an internal server was, because it is reachable by anyone with the password. Our brief on ransomware as a business risk covers the finding that most victims already had multi-factor authentication; the gaps were in the places nobody checked.

The five questions

You do not need to understand cloud architecture to establish whether your organisation is in reasonable shape. You need specific answers to five questions, and the quality of the answers tells you most of what you need.

Ask them in that order, because each depends on the one before it. You cannot say who has access until you know what exists, and you cannot know whether you would notice an incident until you know what is exposed.

Pay particular attention to the answer to the first. In most organisations the honest reply involves a spreadsheet that is out of date, and the gap between it and reality is where the unapproved tools live. That gap is the 43 percent figure above, expressed locally.

Three decisions that are yours

What you are willing to lose access to, and for how long. Cloud services fail, accounts get locked, and providers occasionally suspend businesses over billing or policy disputes. Somebody needs to state which services the organisation genuinely cannot operate without for a day, and whether an independent copy of the data in them exists. This is a business continuity question wearing technical clothing.

Whether the approved route is easier than the unapproved one. Staff adopt unsanctioned tools because they have work to do and the sanctioned option is slow, missing or unknown. If procurement takes six weeks and a corporate card takes six minutes, no policy will hold. The fix is usually a faster approval path with a small set of pre-cleared options, not a stricter prohibition.

Who owns cloud security, by name. In a surprising number of organisations, cloud platforms are administered by whoever set them up, security is assumed to be the provider’s job, and no individual holds the responsibility. Naming a person, even part-time, changes outcomes more than most tooling does.

What good looks like

An organisation in reasonable shape is not one with the most tools. It is one where somebody can produce a current list of cloud services within a day, where administrative accounts use phishing-resistant sign-in, where nothing is exposed to the internet by accident, where logs exist and someone reads them, and where a person’s name sits against the responsibility.

None of that requires a large budget, and all of it requires attention. The organisations that come through cloud incidents well are consistently the ones that had already decided who does what, which is the same finding that shows up in every other area of this subject.

Last verified: 7 August 2026. Survey findings describe the organisations sampled rather than the whole economy. The IBM study covers 602 organisations that experienced a breach, so its figures describe breached organisations rather than all organisations.