Research shows that 97 percent of organizations experienced at least one cloud security incident in 2025. Despite growing confidence, the development of a coherent cloud strategy is still lacking, leading to ongoing incidents and loss of productivity.
Cloud security remains a sensitive issue for many organizations, despite the optimism companies themselves project. According to the latest Red Hat State of Cloud-Native Security Report, practice is more challenging than expected, with numerous incidents and a striking gap between perception and reality. Furthermore, the consequences extend beyond just the IT department.
The study gauges security practices in cloud-native environments at companies worldwide, based on 600 respondents from various sectors. They are responsible for applications, platforms, and security at organizations with at least one hundred employees.
Misconfigurations
Nearly all surveyed organizations faced at least one incident in their cloud environment over the past year. The most common cause appears to be misconfiguration of infrastructure or services, which played a role in 78 percent of incidents. Additionally, 74 percent reported that workloads with known vulnerabilities were deployed, while 67 percent dealt with issues regarding regulatory non-compliance.
Notably, more than half of the organizations describe their cloud approach as proactive, while only 39 percent actually have a well-developed strategy. More than one in five organizations even operates entirely without a strategic plan, which predictably leads to more security problems.
Impact on productivity
The consequences of these incidents are felt throughout the entire organization. For instance, 74 percent of companies delayed or limited application deployments due to security issues. Furthermore, 92 percent indicated that incidents resulted in more remediation work, lower developer productivity, and loss of customer trust. At 61 percent, organizations with a mature strategy show significantly more confidence in the security of their software supply chain.