2025年云与AI安全状况调查报告

© 2025 Cloud Security Alliance – All Rights Reserved. You may download, store, display on yourcomputer, view, print, and link to the Cloud Security Alliance at https://cloudsecurityalliance.orgsubject to the following: (a) the draft may be used solely for your personal, informational, non-commercial use; (b) the draft may not be modified or altered in any way; (c) the draft may not beredistributed; and (d) the trademark, copyright or other notices may not be removed. You may quoteportions of the draft as permitted by the Fair Use provisions of the United States Copyright Act,provided that you attribute the portions to the Cloud Security Alliance. Acknowledgments Lead Author Hillary Baron Contributors Marina BregkouJosh BukerRyan GiffordAlex KaluzaJohn Yeoh Graphic Design Claire LehnertStephen Lumpe About the Sponsor Tenable® is the exposure management company, exposing and closing the cybersecurity gaps thaterode business value, reputation, and trust. The company’s AI-powered exposure managementplatform radically unifies security visibility, insight, and action across the attack surface, equippingmodern organizations to protect against attacks, from IT infrastructure to cloud environmentsto critical infrastructure and everywhere in between. By protecting enterprises from securityexposure, Tenable reduces business risk for approximately 44,000 customers around the globe.Learn more at tenable.com. www.tenable.com Table of Contents Acknowledgments...............................................................................................................................3Lead Author...................................................................................................................................3Contributors..................................................................................................................................3Graphic Design..............................................................................................................................3About the Sponsor........................................................................................................................3Executive Summary.............................................................................................................................5Key Findings........................................................................................................................................6Key Finding 1: Hybrid and Multi-Cloud Dominate...........................................................................6Key Finding 2: Identity Has Become the Cloud’s Weakest (and Organizations’ MostWatched) Link................................................................................................................................8Key Finding 3: The Expertise Gap Creates a Leadership Alignment Challenge............................10Key Finding 4: Fighting Fires Instead of Preventing Them–Measuring Breaches, Not Prevention12Key Finding 5: AI Adoption Accelerates While Security Targets the Wrong Risks.......................13Key Finding 6: Time for a Security Strategy Reset.......................................................................16Conclusion.........................................................................................................................................17Full Survey Results.............................................................................................................................18Demographics...................................................................................................................................26Survey Methodology and Creation....................................................................................................27Goals of the Study.......................................................................................................................27 Executive Summary Hybrid and multi-cloud architectures have become the standard for most organizations, with 82%operating hybrid environments and 63% using multiple cloud providers. At the same time, AI adoptionis accelerating, with over half of organizations deploying AI for business needs—and 34% of those withAI workloads already experiencing breaches. Yet security strategies have not kept pace, leaving teamsreactive and fragmented. This survey reveals six critical insights: 1. Hybrid and Multi-Cloud Dominate:Flexible infrastructure demands unifiedsecurity visibility and policy enforcement—still lacking for most. 4. Measuring Breaches, Not Prevention:KPIs remain reactive, focused on incidentsinstead of risk reduction and resilience. 5. AI Adoption Outpaces SecurityReadiness: 2. Identity Risks Lead But RemainUnder-Managed: Organizations prioritize compliance andnovel AI risks over proven cloud and identitycontrols. Identity is now the top risk and breach cause,but many organizations rely on basic controlsand metrics, missing deeper g