Nearly all organizations now run production workloads in the cloud, yet only 40% consider their cloud security strategy advanced or optimized, highlighting a significant maturity gap, according to SANS.

This is according to the 2026 SANS Cloud Security Survey Insights report which surveyed 400 IT and security professionals.

SANS found that 51% of respondents were running enterprise-scale (2501 to 10,000 workloads, containers, or instances) or hyperscale (more than 10,000) environments and 73% already having a dedicated cloud security team or role.

The report also noted that 93% of organizations already run production workloads in the cloud and 65% run more than one provider.

SANS noted that because so many respondents have a dedicated team for cloud security, it indicates that a maturity gap persists despite organizations being well-resourced.

Overall, 45% of respondents described their cloud security strategy as “intermediated” with partial implementation of a defined strategy.

This partial implementation is an issue, according to the report, and leads to security incidents.

Misconfiguration Make Up Nearly Half of Critical Cloud Incidents

The report found that misconfiguration is the leading cause of critical cloud incidents (45%), close to double that of the next highest factor, credential theft, which made up 22% of incidents.

What’s more, misconfigurations often remain in place for significant periods, with around half of organizations (49%) found to need more than 24 hours to close a known critical gap.

"Misconfiguration is not an exotic attack class. It is a known gap sitting in an account somebody already owns," said Serge Borso, SANS Principal Instructor. "What makes it persist is not the attacker. It is the distance between finding the gap and fixing it, across too many consoles with nobody clearly owning the result. That is why consolidation and enforcement matter more right now than implementing yet another detection tool. The industry has finished deciding to move to the cloud and is now paying for how fast it did.”

Despite the security maturity gap, cloud security budgets were found to be increasing for most, with 28% of respondents reporting significant investment to modernize or adopt new technology such as AI or Cloud-Native Application Protection Platform (CNAPP), and another 42% reporting incremental growth.

Overall, 70% of organizations are spending more on cloud security than a year ago. Only 7% reported budget cuts.

Just 21% of respondents said their organization runs a single consolidated CNAPP platform. Meanwhile, 31% still maintain separate point solutions across Cloud Security Posture Management (CSPM), Cloud Workload Protection Platform (CWPP), and Cloud Infrastructure Entitlement Management (CIEM). Of those surveyed, 23% are actively evaluating a move to consolidate.

The SANS data points towards three priorities for security teams in the year ahead:

• Strengthen cloud security by enforcing automated policy checks in infrastructure-as-code pipelines, preventing misconfigurations before deployment
• Reduce security tool sprawl by consolidating posture management, workload protection and identity security tools into unified platforms
• Extend zero trust beyond authentication by adopting continuous, context-based controls that limit what users and workloads can access after login