Originally published by Tenable.
Written by Thomas Nuth, Head of Product Marketing - Cloud, Tenable.
TL; DR
Unify AI and cloud exposures into a clear and manageable security view — before your board asks why your organization is moving so fast without AI and cloud security guardrails.
Key takeaways
If you’re in security, watching your organization deploy AI and cloud resources at breakneck speed can feel like trying to inspect every car on a highway from a single, manual toll booth.
If you try to stop every new AI or cloud project for a prolonged security and compliance review, employees will find unique ways to bypass your cloud security and AI acceptable use policies (AI AUP). A developer might use a personal API key to finish a sprint. Or a marketer might feed sensitive data into an unvetted browser extension to meet a deadline. These shadow AI workflows leave your security teams blind to where your data goes.
When teams go around your controls, they leave behind a trail of misconfigurations, unpatched vulnerabilities, and service accounts with excessive permissions. Those shortcuts quickly add up.
According to the State of Cloud and AI Security Report 2025, 59% of professionals said insecure identities and risky permissions are the single greatest threat to their cloud infrastructure, and 34% with AI workloads have already experienced an AI-related breach. That same report also found that 53% of organizations have given external accounts the ability to assume critical severity, excessive permissions.
Since AI is effectively the most data-hungry workload in your cloud, these gaps become building blocks of an attack path that leads straight to your AI models and your most sensitive data.
The current strategy of layering more specialized tools to regain control has left the typical large-scale enterprise with 70 or more security vendors, which creates exposures adversaries exploit. They can move across silos, from a misconfigured cloud identity to sensitive AI data.
Many organizations have an invisible attack surface of unsanctioned large language models (LLMs) and unvetted AI agents. The risk is in your internal AI development lifecycle, and the shadow AI and data buckets in your cloud that siloed security tools don’t know exist.
One study says that 3% of organizations expose AI-related API keys (like OpenAI and Anthropic) within cloud data resources, while 18% have overprivileged identity and access management (IAM) roles that AWS AI services can instantly assume. These exposures are a silent, wide-open backdoor for data exfiltration.
The solution is an AI exposure management strategy that treats AI tools and the cloud infrastructure they run on as a single, interconnected stack. Managing automated agents or AI model training separate from cloud security is a mistake that could end in an incident report you can’t defend.
Think of your cloud environment like a high-performance car you’re actively building while it’s speeding down a highway.
Most security tools are like a dashboard full of blinking lights. Individually, they tell you one problem at a time, but they don’t have context. You know you have alerts, but you can’t see they’re connected. Eventually, your engine will fail and cost you a lot of time and money.
It’s the same with AI security in the cloud. You don’t need more data. You need telemetry that connects the dots. Finding those toxic combinations, like a known vulnerability on a public-facing web server that shares a service account with an AI data lake, is what prevents an oversight from becoming a critical cyber incident.
Effective cloud exposure management helps your teams see these high-risk pathways. You can protect your cloud infrastructure and AI data by locking down your identity perimeter and stripping away those excessive entitlements. It’s more than routine maintenance. It’s how you keep the company car on the road without becoming the one who has to tell the board about the massive financial loss from an accident no one saw coming.
In the context of AI security in the cloud, a fragmented view is a liability. That’s because you can’t secure an AI data lake using the same siloed logic used for legacy databases.
For example, you’ve probably sat through multiple consecutive status meetings where three different teams (IT, cloud security, and OT security) present three versions of the same risk. Fragmented reporting happens when IT, security, and compliance teams work in domain-specific silos that don’t talk to each other.
But attackers don’t care about organizational silos. They exploit the friction between them to move from a compromised cloud app to your AI data lake. By integrating AI and cloud security, you can find these attack chains before threat actors and reduce the time to contain a breach.
You can’t stop your organization from rapidly adopting LLMs, automated agents, or more cloud containers and workloads. What you can do is not be the one who has to write the incident report when a siloed tool doesn’t find shadow AI or a cloud service an employee spun up to bypass your manual review.
According to the IBM Cost of A Data Breach Report 2025, organizations using AI and automation extensively for security saved about $1.9 million in breach costs and reduced the breach lifecycle by about 80 days.
Your goal this year is to stop collecting disjointed security tools that only create more noise while your organization speeds past you. When you unify your AI cloud security and infrastructure governance, you can build a security guardrail that maintains AI and cloud speed without ending up in a 2 a.m. breach crisis meeting.
AI-powered exposure management is the only way to keep your eyes on the road and ensure your entire organization sees security as a competitive advantage, not a roadblock.
Start by acknowledging your organization is already AI and the cloud. Trying to block every LLM or cloud instance is a losing game that encourages shadow IT. Instead, implement an AI in cloud security governance framework with visibility into how data moves into these models and across the cloud. If you can show your organization that you have guardrails in place, you become a partner in the rollout instead of a bottleneck.
Most breaches start with an over-privileged service account or a leaked key. If an attacker gets access to an identity with excessive entitlements, they can move laterally across your environment, regardless of your firewall settings. Focusing on exposure management helps you find and kill exposures and their attack paths.
Yes. The best exposure management platform enables tool and data consolidation to close the gaps that naturally form between disconnected security products. When your vulnerability data, cloud configuration, AI security, and identity permissions are in one place, like within an exposure assessment platform (EAP), you get a clear view of your most critical exposures.
Thomas Nuth is a seasoned cybersecurity executive with over 15 years of experience driving global go-to-market strategy, brand development, and market adoption for some of the world’s most innovative security companies. With a deep understanding of the evolving threat landscape—from cloud-native risk to AI-powered attacks—Thomas has played a pivotal role in shaping industry narratives and positioning next-gen technologies at the forefront of the cybersecurity conversation. Before joining Tenable, Thomas held positions at Wiz, Qualys, Fortinet, Forescout, and other innovative leaders in cybersecurity.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。