A report shows that with 40.000 times more machine identities than human ones, this poses a challenge for corporate security. At the same time, organizations are increasingly gaining more insight into their cloud landscape – 92 percent of companies already operate without risky human users.
The new “2025 Cloud-Native Security and Usage Report” provides in-depth insights into current trends in cloud security and usage, highlighting both significant progress and urgent areas for action for companies.
According to the report, organizations of all sizes and industries in North America, EMEA, and APJ are making measurable progress in identity and vulnerability management, AI security, and threat detection and response. At the same time, the increasing use of AI and the growth of cloud infrastructure are creating new challenges, including the increasing complexity of machine identities, overloaded container images, and automated attacks.
Advances in cloud security
AI usage grows – security remains a priority: The use of AI and machine learning workloads increased by 500 percent last year. At the same time, the share of generative AI packages more than doubled. Despite this rapid growth, the public attack surface decreased by 38 percent, indicating increased security for AI applications.
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a monthFaster threat detection and response: Experienced security teams now detect threats in less than five seconds and initiate countermeasures within an average of 3,5 minutes – faster than the historical ten-minute window that previously gave attackers an advantage.555 Cloud Detection and Response Benchmark“ is not only possible, but essential.
Vulnerability management is becoming more targeted: The proportion of actively exploited vulnerabilities has fallen to below 6 percent—a 64 percent decrease over the past two years. Companies are increasingly focusing on closing exploitable vulnerabilities in production environments and optimizing their security strategy.
Open source security is becoming the standard: Companies around the world are increasingly relying on open source security tools such as Kubernetes, Prometheus, and Falco. More than 60 percent of Fortune 500 companies use Falco to secure their cloud infrastructures, underscoring the growing trust in open source security standards.
Challenges for the coming year
Machine identities are a growing vulnerability: With 40.000 times more machine identities than human identities, the attack surface expands significantly. Furthermore, machine identities are 7,5 times more vulnerable – an alarming development, since almost 40 percent of all security breaches begin with compromised credentials.
Container lifecycles are shortening, but attackers are still fast enough: For the first time, 60 percent of all containers have a lifetime of less than 60 seconds. While these short-lived workloads increase agility, attackers are using automated reconnaissance techniques to exploit vulnerabilities in real time. Instant threat detection is therefore more important than ever.
Overloaded container images increase the risk: The average size of container images has increased fivefold, creating unnecessary security risks and inefficient operational processes. Larger images expand the attack surface and increase operational costs, highlighting the need for leaner, more efficient container solutions.
Attackers also rely on open source: While open source security tools have become essential for businesses, cybercriminals continue to leverage open source malware and target open source software as an attack vector – a trend already observed in Sysdig's 2024 Global Threat Year-in-Review.
"Cybersecurity has always been an arms race between attackers and defenders—but the battlefield is changing," explains Crystal Morin, Cybersecurity Strategist at Sysdig. "Organizations have made tremendous progress, particularly in reducing response times to threats. But with the growing number of machine identities and the dynamically evolving cloud environment, automation and rapid response are more important than ever. However, the data in this report makes me optimistic about the future of cyber defense."
Go directly to the PDF report at Sysdig.com
About Sysdig
In the cloud, every second counts. Attacks occur within minutes – security teams must protect companies without compromising their agility. Sysdig, recognized as a Customers' Choice in Gartner's "Voice of the Customer" report for Cloud-Native Application Protection Platforms (CNAPPs), stops cloud attacks in seconds and detects risks in real time with open security solutions like Falco. Sysdig Sage™, the industry's first AI-powered cloud security analyst, improves responsiveness and enables faster collaboration between security, developers, and DevOps.