Global survey finds gaps leave cloud security dangerously exposed

Check Point has released its 2025 Cloud Security Report, revealing systemic vulnerabilities in cloud security across global enterprises and highlighting key areas where risk and operational inefficiency are leaving organisations exposed.

The report is based on a survey of 937 chief information security officers (CISOs) and IT leaders worldwide, focusing on the challenges faced in securing hybrid, multi-cloud, and edge environments. It documents that 65% of organisations suffered a cloud-related security incident in the past year, a rise from 61% in the previous year.

The findings underscore the difficulties companies are experiencing in keeping up with rapid technological change and increasingly sophisticated cyber threats. Only 9% of organisations detected a cloud incident within the first hour, with just 6% managing to remediate such incidents in the same timeframe. This gap provides intruders with more opportunity to remain undetected and exploit weaknesses within cloud environments.

Paul Barbosa, Vice President of Cloud Security at Check Point, commented: "Security teams are chasing an ever-moving target. As cloud environments grow more complex and AI-driven threats evolve, organisations can't afford to be stuck with fragmented tools and legacy approaches. It's time to shift toward unified, intelligent, and automated defences designed for the realities of today's decentralised world."

The report highlights that cloud adoption continues to outpace security preparedness, with 62% of organisations now using cloud edge technologies, 57% operating hybrid cloud models, and 51% using multi-cloud strategies. Legacy, perimeter-based defences have proven inadequate in keeping pace with these distributed architectures.

In terms of detection and remediation, the report found that most organisations remain vulnerable, as 62% took more than 24 hours to remediate breaches. This delay in response time presents attackers with a significant opportunity to escalate access and inflict greater harm.

The complexity of cloud security toolsets emerged as an additional concern. The report found that 71% of respondents depend on more than 10 different cloud security tools, and 16% use over 50 tools. More than half of these respondents report experiencing nearly 500 security alerts each day. This high volume of alerts results in alert fatigue, which can slow response times and increase the likelihood that genuine threats are missed.

Application security appears inadequate for combating modern threats, with 61% of organisations still relying on traditional, signature-based web application firewalls. These are increasingly ineffective against attacks enhanced by artificial intelligence.

While 68% of respondents listed artificial intelligence as a top priority for cyber defence, only 25% felt confident in their ability to respond to AI-driven attacks, illustrating a significant gap in capability and readiness to address emerging threats.

Visibility into lateral movement—where attackers move undetected between systems within a cloud environment—remains limited. Only 17% of organisations reported having full visibility into east-west cloud traffic. As a result, once attackers breach an initial perimeter, they often have the ability to move freely and undetected within cloud environments.

Detection of threats is also problematic, with only 35% of incidents identified by automated security monitoring platforms. The majority are detected by employees, through audits, or via external reports, exposing shortcomings in real-time threat detection capabilities.

Internal challenges further complicate progress. The report notes that 54% of respondents pointed to the rapid pace of technological change as a major obstacle. A shortage of skilled security professionals also represents a substantial barrier for 49% of those surveyed. In addition, 40% identified fragmented toolsets and poor integration between platforms as drivers that slow response and exacerbate visibility gaps.

The survey was conducted by Cybersecurity Insiders in early 2025 and included CISOs, cloud architects, security analysts, and IT leaders from across North America, Europe, Asia-Pacific, and other regions. Respondents were asked about cloud security issues, the adoption of artificial intelligence, and the complexities associated with current security architectures.

Check Point's recommendations include a move towards decentralised, prevention-focused cloud security strategies. The report advises organisations to consolidate their tools, adopt AI-powered threat detection, and implement real-time telemetry to achieve full visibility across all cloud deployments. The company suggests that using its CloudGuard and Infinity Platform solutions can help firms unify defences, automate incident response, and maintain consistent policy enforcement across platforms and providers.

Deryck Mitchelson, Global CISO at Check Point, provided further perspective in the report: "Cloud transformation is accelerating faster than our defences. With attackers moving in minutes and defenders responding in days, the gap between detection and remediation is becoming a danger zone. CISOs must consolidate fragmented tools into unified platforms, gain visibility into lateral movement, and prepare their teams and technologies to counter AI-driven threats, or risk ceding control of the cloud to increasingly sophisticated adversaries."