Cloud infrastructure has become essential to modern enterprise operations – but as its use deepens, so do the challenges of securing it.

The latest 2025 Global Cloud Security Study from Thales paints a picture of mounting strain on security teams worldwide, with AI initiatives accelerating cloud complexity and pushing sensitive data further into vulnerable environments.

Based on responses from nearly 3,200 security professionals across 20 countries, the research reveals a major shift in how organisations approach cyber-defence, with AI security spending now displacing traditional security investments.

The report found that over half (52%) of respondents reported that AI-specific protections are taking priority – ranking second only to cloud security as the top investment area globally.

Despite this reprioritisation, the study finds that most enterprises remain underprepared for the cloud security risks they face – especially as the volume of sensitive data increases.

Cloud is Critical – But Still Under-Secured

According to the study, 64% of enterprises rank cloud security among their top five security priorities, with 17% identifying it as number one. Yet the majority continue to lag in implementing core protections.

More than half (54%) of all data stored in the cloud is now considered sensitive – up from 47% last year – but only 8% of respondents say they encrypt 80% or more of their cloud data. Additionally, just 66% of organisations have deployed multi-factor authentication (MFA) to guard cloud access.

Security teams are increasingly dealing with attacks that directly target cloud infrastructure. In fact, four of the five most targeted enterprise assets in reported incidents are now cloud-based.

The leading cause of breaches? Credential misuse. Some 68% of respondents cited stolen secrets and compromised credentials as the fastest-growing threat tactics, while 54% reported a rise in direct infrastructure attacks. Despite awareness of these risks, cloud misconfigurations and poor identity controls remain common – with human error continuing to be a persistent liability.

SCloud/SaaS Sprawl & Digital Sovereignty

Cloud’s growing complexity is proving to be one of its greatest security challenges. On average, enterprises now use 2.1 public cloud providers alongside on-premise systems, and rely on 85 SaaS applications – a 6% increase from the previous year. These figures highlight the scale of integration and the security burden that comes with it.

More than half of those surveyed (55%) said securing cloud environments is harder than securing on-prem systems – a figure that has risen from 51% last year. The operational strain is reflected in tooling: 57% of respondents now juggle five or more key management systems, while 61% use at least five different tools for tasks like data discovery and classification.

This fragmentation not only increases complexity, but weakens visibility, makes policy enforcement inconsistent, and opens doors for attackers to exploit overlooked vulnerabilities.

The study also explores how organisations are thinking about digital sovereignty – the ability to maintain control over data and workloads regardless of where they’re hosted.

Recommended reading

• Can Europe ‘Trump-Proof’ Its Cloud Services?
• Security, Compliance, AI Concerns Driving Private Cloud Adoption
• What Top Trends Are Shaping the Future of Cloud?

Just under half (42%) of respondents believe that encryption and robust key management are sufficient to meet sovereignty objectives, while 33% cited workload portability and data mobility as key priorities. These findings suggest that for many, long-term sovereignty goals are rooted in strategic flexibility and cloud-agnostic design.

“The accelerating shift to cloud and AI is forcing enterprises to rethink how they manage risk at scale,” said Sebastien Cano, senior vice president, Cyber Security Products at Thales.

“With over half of cloud data now classified as sensitive, and yet only a small fraction fully encrypted, it’s clear that security strategies haven’t kept pace with adoption.

“To remain resilient and competitive, organisations must embed strong data protection into the core of their digital infrastructure.”