SANS’S 2026 Cloud Security Survey Insights, based on responses from 400 IT and security professionals, found that 93% of organisations run production workloads in the cloud and 65% use more than one provider. Yet only 40% described their cloud security strategy as advanced or optimised, while 45% said it was “intermediated”, with a defined strategy only partly implemented. More than half of respondents operated enterprise-scale or hyperscale environments, and 73% had a dedicated cloud security team or role. SANS said the findings point to a maturity gap despite organisations having specialist resources.
Misconfiguration was cited as the cause of 45% of critical cloud incidents, nearly twice the 22% attributed to credential theft. Around half of organisations (49%) took more than 24 hours to close a known critical gap. SANS Principal Instructor Serge Borso said the delay in finding and fixing gaps, and unclear ownership, help misconfigurations persist.
Cloud security spending is rising for most respondents: 28% reported significant investment and 42% incremental growth compared with the previous year; 7% reported budget cuts. However, only 21% used a single consolidated cloud-native application protection platform (CNAPP), while 31% retained separate tools for posture management, workload protection and identity entitlements.
SANS highlighted automated policy checks in infrastructure-as-code pipelines, reducing tool sprawl and extending zero-trust controls beyond login as priorities for the year ahead.