SANS Warns of Cloud Security Maturity Gap

“Misconfiguration is not an exotic attack class. It is a known gap sitting in an account somebody already owns.”

Cloud adoption is nearly universal — security maturity is not

The 2026 SANS Cloud Security Survey Insights, polling 400 IT and security professionals, found that 93% of organizations now run production workloads in the cloud and 65% use more than one provider. Yet only 40% of respondents described their cloud security strategy as advanced or optimized. A plurality — 45% — called their strategy “intermediated,” meaning a defined plan exists but is only partially implemented.

Scale is large: enterprise and hyperscale footprints are common

SANS reports that 51% of respondents operate at enterprise-scale (2,501–10,000 workloads, containers, or instances) or hyperscale (more than 10,000). Despite that scale, 73% said their organization has a dedicated cloud security team or role — a signal that resources are in place even as strategy implementation lags.

Misconfiguration drives the most critical incidents

When SANS examined the root causes of critical cloud incidents, misconfiguration led the field at 45% — roughly double the next item, credential theft, at 22%. The report highlights not just the frequency of misconfigurations but their persistence: about half of organizations (49%) need more than 24 hours to close a known critical gap. SANS Principal Instructor Serge Borso framed the problem bluntly: “What makes it persist is not the attacker. It is the distance between finding the gap and fixing it, across too many consoles with nobody clearly owning the result.”

Budgets are growing — consolidation and modernization remain uneven

Cloud security spending appears to be increasing overall. SANS found that 70% of organizations are spending more on cloud security than a year ago; only 7% reported budget cuts. Within that trend, 28% of respondents reported significant investment to modernize or adopt new technologies such as AI or Cloud-Native Application Protection Platform (CNAPP), while another 42% indicated incremental growth.

Despite investment, tool architecture varies. Just 21% of respondents said their organization runs a single consolidated CNAPP platform. Thirty-one percent still maintain separate point solutions for Cloud Security Posture Management (CSPM), Cloud Workload Protection Platform (CWPP), and Cloud Infrastructure Entitlement Management (CIEM). Meanwhile, 23% are actively evaluating a move to consolidate.

Operational priorities SANS says should follow the findings

The report points security teams toward three near-term priorities: enforce automated policy checks in infrastructure-as-code pipelines to prevent misconfigurations before deployment; reduce security tool sprawl by consolidating posture management, workload protection and identity security into unified platforms; and extend zero trust beyond authentication through continuous, context-based controls that limit access after login. Those recommendations map directly to the problems the survey quantified: persistent misconfigurations, fragmented tooling, and delayed remediation.

What this means for technologists, procurement leaders, and end users

• Technologists and security teams: The data pushes toward operational fixes — build automated policy checks into IaC pipelines and assign clear ownership for remediation. The persistence of known gaps (49% needing more than 24 hours to close critical issues) makes faster closure and enforcement primary tactical goals.
• Procurement and enterprise leaders: Budgets are rising (70% spending more), but only 21% run a consolidated CNAPP. Procurement decisions will shape whether organizations continue with point-solution stacks (31%) or move toward consolidation (23% actively evaluating), affecting both cost and the speed of enforcement.
• End users and customers: The prevalence of misconfiguration-driven incidents (45% of critical incidents) and slow remediation windows mean that data and service continuity exposures remain a practical risk until enforcement and consolidation reduce the number and lifespan of such gaps.

SANS’s portrait is stark and specific: nearly universal cloud adoption, sizable and resourced environments, but a gap between having teams and having an implemented, optimized strategy. The survey’s numbers — misconfiguration as the top cause of critical incidents, long remediation windows, and split approaches to CNAPP consolidation — point to a practical agenda. Whether organizations convert budget increases into the automated enforcement and tool consolidation SANS recommends will determine if those gaps shrink or simply shift shape as cloud assets expand.

https://www.infosecurity-magazine.com/news/cloud-security-maturity-lags-sans/