Organizations are struggling to detect, investigate, and contain cloud threats before adversaries achieve their goals. The new CrowdStrike State of Cloud Detection and Response (CDR) Survey highlights the primary challenges they face:
Together, these challenges are creating opportunities for threat actors to successfully breach cloud environments.
The consequences of poor cloud security are difficult to ignore: 94% of organizations report experiencing cloud intrusions that resulted in data exposure or exfiltration.
Understanding cloud risk is not the same as detecting active adversaries. While visibility into configurations, permissions, and exposed resources helps organizations understand potential exposure, detecting threats requires visibility into what is happening across both the cloud control plane and workloads, and the ability to correlate activity across both layers.
Yet many organizations lack complete coverage across either. More than half (56%) report that gaps in cloud control plane visibility negatively impact their ability to detect adversaries, while 95% say not all cloud workloads and instances are covered by security sensors or agents. As a result, 73% of organizations cannot consistently guarantee detection of cloud intrusions, highlighting how visibility gaps directly translate into detection gaps.
These visibility challenges are becoming more difficult as AI adoption accelerates cloud growth, increasing both the scale of environments that must be monitored and the number of opportunities for adversaries to operate. Today, 83% of organizations run AI/ML workloads in the cloud, and 81% have experienced incidents targeting those environments. As organizations expand their cloud footprint, maintaining complete visibility becomes more difficult, and reliable threat detection becomes harder to achieve.
But visibility alone does not solve the problem. The sheer volume of cloud activity makes it difficult to determine which signals indicate real threats and which represent normal operations.
Cloud environments are built on trusted relationships between identities, services, and APIs, and adversaries are increasingly exploiting this model to blend into legitimate activity. As a result, malicious behavior can appear nearly indistinguishable from normal cloud operations.
In fact, 78% of organizations report they cannot reliably distinguish legitimate activity from malicious behavior, forcing analysts to spend valuable time validating activity that often turns out to be benign. The result is an overwhelming volume of alerts: 79% say their tools generate too many alerts, and teams spend roughly 77% of their triage time investigating false positives and low-priority alerts.
The consequences extend beyond analyst fatigue. Faced with overwhelming volumes of activity and limited context, organizations are increasingly forced to make trade-offs. Nearly all (98%) report they do not remediate every identified threat, meaning many detections are ultimately deprioritized or ignored.
Identifying a threat is only part of the battle. Organizations must also detect and respond before adversaries can achieve their objectives.
Cloud detections are frequently delayed by how telemetry is collected and processed, forcing organizations to respond to activity that has already occurred rather than activity unfolding in real time. More than two-thirds (68%) of organizations take 15 minutes or more to detect a cloud intrusion, and over half (51%) require at least an hour. By the time detections are surfaced, adversaries may have already established persistence, moved laterally, or escalated access.
Even when organizations identify malicious activity, containing it before impact remains difficult: 91% of organizations report they are unable to contain all cloud intrusions in real time, highlighting a significant gap between detection and response.
This gap is exacerbated when detection, investigation, and response actions are spread across disconnected systems — another challenge organizations face. Organizations use an average of three tools to detect cloud breaches, while 67% report significant or moderate gaps in integrating cloud detections into their SOC or security information and event management (SIEM) workflows.
This fragmentation forces teams to slow down. Nearly 80% of organizations rely heavily on manual investigations when responding to cloud threats. This requires analysts to stitch together context across multiple systems before they can act.
These inefficiencies have real consequences. Among organizations that experienced breaches, 38% cite tool fragmentation as a contributing factor in intrusions escalating. When detections, investigations, and response workflows are spread across disconnected systems, operational friction creates additional opportunities for adversaries to succeed.
The findings reveal that cloud breaches are rarely the result of a single failure. Instead, they emerge from a series of interconnected gaps across the detection and response lifecycle.
Incomplete visibility obscures attacker activity. Alert noise and limited context make it difficult to determine what matters. Delays in detection and response give adversaries time to achieve their objectives, while fragmented tools and workflows slow efforts to investigate and contain threats.
Individually, each challenge creates risk. Together, they create opportunities for adversaries to move undetected, achieve their objectives, and turn cloud intrusions into breaches.
Explore the full CrowdStrike State of CDR Survey for a deeper analysis of the CDR gaps impacting teams today.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。