State of Security 2026: Cloud Security

The shift to the cloud has relieved organisations of the complexity of managing their own infrastructure, but it has introduced an entirely new set of challenges. As CISOs look out across technology landscapes that span multiple public clouds, hybrid environments, and SaaS providers, they face the need to maintain the security of a complex and diverse environment.

The cloud now dominates new workload deployment, accounting for the majority of IT spending and hosting a growing share of enterprise data. Forrester’s Data And Analytics Survey, 2025 for example reported that 62 percent of enterprise data was now stored in the cloud.

The result is that some enterprises now operate hundreds of sanctioned cloud services, alongside many more that remain undocumented.

This fragmentation has forced a fundamental rethink of how cloud security is managed. Identity has emerged as an important battle ground for cyber defenders, supplanting the network as the key point of vulnerability.

The problem is no longer unauthorised access to the network, but authorised access used in unauthorised ways. This has driven the adoption of zero trust principles, and increased investment in the tools required to enforce them across cloud environments.

This shift is also reshaping investment patterns for cloud security. One of the clearest beneficiaries have been makers of identity and access management (IAM) controls, as CISOs prioritise identity as the foundation of security. According to Forrester, spending on identity and access management (IAM) is growing at around 15 percent annually, significantly faster than the broader security market, and is estimated to be worth US$27.5 billion ($39.5 billion) by 2029.

Closely related to the rise of IAM as a key protection for cloud workloads is the growing market for identity threat detection and response (ITDR) tools, which focus specifically on detecting and responding to identity misuse, including attack vectors such as lateral movement and privilege escalation.

The rise of ITDR reflects a recognition that identity has become a primary attack surface requiring specialised detection and response capabilities. Markets and Markets already estimates ITDR as having been worth US$12.8 billion ($18.4 billion) in 2024, rising to US$35.6 billion ($51.1 billion) in 2029.

Expansion of this market is expected to be further fuelled by growth in machine identities, including the use of APIs, service accounts, and containers and microservices, as well as growth in bots, scripts, automation tools – and AI agents.

Another significant growth area for cloud security are cloud-native application protection platforms (CNAPP), which according to Gartner, describe a unified and tightly integrated set of security and compliance capabilities spanning cloud-native infrastructure and applications.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts