- A new global survey of more than 1,100 cybersecurity leaders has revealed a widening mismatch between AI adoption and security
- The findings were published in the 2026 State of Cloud Security Report
- The analysis identifies three reinforcing pressures behind the complexity gap
A new global survey of more than 1,100 cybersecurity leaders has revealed a widening mismatch between the adoption of AI‑driven cloud environments and organisations’ ability to secure them effectively.
The findings, published in the 2026 State of Cloud Security Report and sponsored by Fortinet, point to what researchers describe as a growing ‘cloud complexity gap’ – a disconnect between the speed of modern cloud operations and security teams’ capacity to maintain real‑time visibility, detection and response.
Vincent Hwang, VP of Cloud Security at Fortinet, notes that as enterprises ‘catapult into an AI-powered future’, cloud security has become central to organisational resilience and ‘perhaps even, survival.’
The report, produced by Cybersecurity Insiders and based on responses from 1,163 senior cybersecurity professionals worldwide, reveals that while investment in cybersecurity continues to rise, the maturity and effectiveness of defences are not keeping pace with increasingly complex cloud use cases, many of which now include AI elements.
The analysis identifies three reinforcing pressures behind the complexity gap. The first is the expansion of fragmented defences. As cloud adoption grows, organisations are accumulating more security tools, often without proper integration. This leads to disconnected systems, inconsistent controls and limited end‑to‑end visibility. Almost 70% of organisations say tool sprawl and visibility gaps are the biggest obstacles to effective cloud security.
The second factor is the strain on cybersecurity teams. Many organisations face a persistent skills shortage and struggle to hire qualified professionals. This ‘gap-within-the-gap’ leaves teams overstretched, contributing to slow responses and missed alerts. Seventy‑four per cent of respondents report an active shortage of cybersecurity talent, while 59 per cent say they remain in the early stages of cloud security maturity.
The third pressure comes from threat actors who are increasingly using automation and AI to exploit vulnerabilities at machine speed. They can uncover misconfigurations, map permission paths and identify exposed data faster than human-led defences can respond. As a result, 66% of cybersecurity experts surveyed say they lack strong confidence in their ability to detect and respond to cloud threats in real time.
The report also highlights the growing complexity of cloud environments themselves. Even single‑provider deployments involve distributed architectures, dynamic identities and expanding data flows. For many enterprises, this complexity is amplified by hybrid and multi‑cloud strategies that combine multiple public clouds, on‑premises infrastructure, SaaS applications and distributed users. According to the survey, 88% of organisations now operate in hybrid or multi‑cloud environments, up from 82% last year. Among them, 81 per cent rely on two or more cloud providers, and 29% use more than three.
As cloud environments grow, so does the attack surface. New services, users and data paths introduce new configurations and permissions, making infrastructure harder to understand and secure. Cybersecurity teams face the challenge of protecting an environment that is constantly evolving.
In response, many organisations are reassessing their security strategies. Survey data shows a clear shift away from isolated point tools and towards unified security ecosystems. If starting from scratch, 64 per cent of respondents say they would choose a single‑vendor platform that integrates network, cloud and application security. Security teams are increasingly overwhelmed by the integration demands of multi‑vendor toolsets, and consolidation promises stronger visibility, faster detection and response, and more proactive threat exposure management.
The report goes on to conclude that organisations must address the combined pressures of hypergrowth, fragmentation, limited cybersecurity expertise and AI‑driven threats if they are to build effective cloud security foundations. For those pursuing AI strategies, establishing a secure operational base is even more critical.
