AI & cloud security top enterprise concerns amid tool sprawl

Techday NZ

a day ago

Thales' newly released 2025 Global Cloud Security Study highlights rising challenges for organisations as cloud complexity and AI adoption re-shape enterprise security priorities.
The study, carried out by S&P Global Market Intelligence 451 Research and based on a survey of nearly 3,200 security professionals in 20 countries, reports that over half (52%) of security leaders are now prioritising AI security spending over traditional allocations. At the same time, more than half of all cloud data is now classified as sensitive, yet only a limited proportion benefits from full encryption.
Shifting security priorities
Findings from the study underscore a notable shift in how security budgets are distributed. While cloud security remains the foremost priority, AI-specific security ranks as the second most important area of investment for businesses, marking a change in enterprise risk management as organisations respond to the accelerated adoption of AI technologies and the rapid proliferation of sensitive data stored in cloud environments.
Almost two-thirds (64%) of respondents consider cloud security one of their five most pressing security concerns, while 17% rate it as their top issue. "The accelerating shift to cloud and AI is forcing enterprises to rethink how they manage risk at scale. With over half of cloud data now classified as sensitive, and yet only a small fraction fully encrypted, it's clear that security strategies haven't kept pace with adoption. To remain resilient and competitive, organizations must embed strong data protection into the core of their digital infrastructure," Sebastien Cano, Senior Vice President, Cyber Security Products at Thales, said.
This reallocation of priorities reflects the increasing pressure placed on security teams as they respond to the volatility and changing threat landscape of cloud and AI environments.
Managing complex cloud environments
Security operations are becoming more complicated as organisations use an average of 85 Software-as-a-Service (SaaS) applications and operate across an average of 2.1 public cloud providers, often alongside on-premises systems. The study reveals that 55% of security professionals believe cloud environments are now more complex to secure than their on-premises counterparts—a four percent increase compared to the previous year.
These trends have contributed to what the report refers to as 'security tool sprawl', with 61% of organisations utilising five or more data discovery, monitoring, or classification tools. Similarly, 57% of surveyed organisations rely on five or more tools for encryption key management.
This proliferation of tools, providers and platforms drives challenges in maintaining consistent policies, managing access, and ensuring data visibility across hybrid and multi-cloud estates. These difficulties are further exacerbated during periods of organisational growth or mergers and acquisitions, which often see expanded SaaS usage and heightened security demands.
Cloud-based assets a primary target
The report points to an evolving threat landscape in which attackers increasingly focus on cloud-based resources. Four of the top five most targeted assets in reported cyberattacks were cloud-based, underlining the risks associated with storing and processing sensitive data in public and hybrid cloud environments.
Incidents involving unauthorised access remain prevalent; 68% of respondents reported a rise in access-based attacks, stemming largely from stolen credentials and lack of adequate access controls. Despite most organisations (85%) classifying at least 40% of their cloud data as sensitive, only 66% have introduced multifactor authentication, leaving critical datasets exposed to potential breaches.
Misconfigurations and lapses in credential management are also cited as primary contributors to cloud security incidents, suggesting an ongoing role for human error in organisational risk profiles. "A rising number of respondents report challenges in securing their cloud assets, an issue that is further amplified by the demands of AI projects that often operate in the cloud and require access to large volumes of sensitive data. Compounding this issue, four of the top five targeted assets in reported attacks are cloud-based. In this environment, strengthening cloud security and streamlining operations are essential steps toward enhancing overall security effectiveness and resilience," Eric Hanselman, Chief Analyst at S&P Global Market Intelligence 451 Research, said.
The findings collectively emphasise the ongoing difficulties enterprises face as they strive to protect and manage increasingly distributed, sensitive, and AI-powered cloud environments, where tools and best practices have yet to fully match the pace of technological adoption and sophistication of threats.