“The increased number of vulnerabilities in the CVE database isn't a theoretical risk,” Datadog wrote in its State of Cloud Security 2026 report published on November 10, and supplied numbers to make that point starkly: the median number of high or critical vulnerabilities in cloud workloads rose from 4 in May to 14 in June and 16 in November.
Data source and scope: Datadog's SCA analysis of thousands of customers
Datadog based the findings on analysis of the cloud security posture of thousands of customer organizations worldwide, using vulnerabilities identified in third‑party libraries through Datadog Code Security’s Software Composition Analysis (SCA) feature. The company framed the rise in high/critical flaws as a practical, observable effect on real applications running in cloud environments, not merely an uptick in inventoryed CVEs.
Frontier AI and timing: the Mythos release and a rapid surge
Datadog tied the timeline to frontier AI: the median number of high/critical severity flaws jumped after Anthropic’s Mythos model was released in May. The firm reported a fourfold increase over the May–November window — from 4 to 16 — with an intermediate spike to 14 in June. Datadog used those figures to argue that newly discovered or exploited vulnerabilities are affecting running workloads at scale.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSupply‑chain risk and machine‑speed adoption of dependencies
Supply‑chain attacks and hijacked dependencies were highlighted as pathways that operate “at machine speed.” Datadog found that some 60% of organizations it analyzed run dependency versions that were released less than 24 hours earlier, and those very-new versions appear in more than one in five (21%) cloud applications. The company also reported that cloud app workloads average 149 software dependencies, while the average organization pulls in 568 dependencies overall. To blunt the risk of rapid, automated compromise through malicious updates, Datadog recommended that organizations “implement dependency cooldowns to lower the risk of malicious dependencies reaching their cloud environments, because the community usually identifies and contains hijacked libraries within a few hours.”
Long‑lived credentials and cloud‑hosted AI inference services
Datadog drew attention to long‑lived credentials as a persistent and high‑value target. Nearly half of organizations using Gemini, the report said, rely on long‑lived Gemini API keys. Across cloud platforms, the share of users with access keys older than three years reached nearly 30% for AWS IAM and Google Cloud Service Account users. Datadog warned that attackers — and automated tools — “enumerate for long‑lived credentials first because they’re the highest‑value, longest‑lived prize in the environment.”
As an alternative, Datadog advised against “static Bedrock or Gemini API keys,” recommending instead that AI inference services be accessed “through the calling workload’s short‑lived identity when supported (IAM role, managed identity, or service account) so the model is reached with the same federated credentials as other cloud resources and not a separate long‑lived key.”
Automated scanners and red‑team tooling used at scale
The report named tooling that finds exposed keys and over‑permissioned credentials at scale: “Red‑team frameworks like Pacu and Datadog’s own Pathrunner along with secret scanners like TruffleHog reliably find over‑permissioned credentials and exposed keys at scale,” Datadog said. It warned that the same tooling is accessible to autonomous attackers and automated scanning systems that continuously probe the web for weaknesses, amplifying the operational risk presented by long‑lived secrets and permissive access.
What this means for technologists, policymakers, and enterprise procurement
- Technologists and security teams: Expect a continued operational need to limit blast radius — through short‑lived identities, tighter credential hygiene, and dependency cooldowns — because Datadog’s data shows vulnerabilities and risky dependencies are present in running cloud workloads, not just in inventories.
- Policymakers and regulators: The findings underline a measurable change in cloud risk posture tied to third‑party dependencies and credential management; the report frames those as concrete attack surfaces that scale with automation.
- Enterprise procurement and cloud architects: With average organizations pulling in hundreds of dependencies and many teams adopting versions within 24 hours, procurement and release processes may need explicit controls to slow automatic adoption of new packages and enforce credential rotation policies.
Datadog’s report leaves no ambiguity about what it views as the practical problem: vulnerabilities and exposed credentials are already present in cloud workloads and are being weaponized at machine speed. Whether organizations adopt short‑lived identities, dependency cooldowns, or stricter secret scanning — the firm’s recommendations are built around reducing opportunity and blast radius rather than relying on perfect vulnerability prevention.
