Studies

Study: More cloud budget does not close the security gap

An international survey shows rising budget expectations alongside low self-assessments of cloud security maturity.

By Alec Chizhik July 22, 2026 4 min read

Study: More cloud budget does not close the security gap

More money for cloud security does not guarantee higher security maturity. In the Cloud Security Report 2026, 62 percent of respondents expected rising budgets for the following twelve months. At the same time, 59 percent placed their company’s cloud security in one of the two lowest maturity levels. The international survey thus points to a tension for IT leaders. It does not, however, establish a causal link between budget and maturity.

Key takeaways

Budget expectations and maturity diverge in the survey. 62 percent expected higher cloud security budgets within twelve months, while 59 percent rated their security maturity as initial or developing.
Tools and visibility are the most frequently cited obstacle. 69 percent cited problems with too many tools and patchy visibility across their cloud environments.
Automation often stops at alerts. 37 percent described their automation as geared primarily towards alerts and recommendations. 11 percent reported fully autonomous remediation workflows.

What the survey says about budgets

The 2026 Cloud Security Report is based on an online survey of 1,163 IT and cybersecurity professionals from various countries and industries. It was conducted in late 2025. Cybersecurity Insiders produced the report, with Fortinet funding it as sponsor.

The budget question referred to the expected development over the twelve months following the survey. The report therefore does not measure whether budgets have actually risen. Maturity, too, rests on a self-assessment. The two findings show a need for action as perceived by respondents. They do not, however, show whether higher spending has changed maturity at individual companies.

For cloud and IT leaders, the practical question is therefore which security problems an investment is meant to resolve and how the outcome can then be measured. Suitable indicators include excessive access rights that have been reviewed or the time taken to remediate a misconfiguration.

Many tools make oversight harder

69 percent of respondents named tool and visibility problems among the greatest obstacles to effective cloud security. 66 percent were at most moderately confident in their ability to detect and respond to threats across their cloud environments in real time.

88 percent reported hybrid or multi-cloud environments. Within this group, the report assigns 81 percent to those who use at least two cloud providers for critical workloads. For day-to-day operations, what matters is whether teams can map accounts, permissions and security-relevant events across these environments.

A sensible first step is an inventory of cloud accounts and those responsible for them. Building on that, teams can check which tools collect the same information and where context is missing when handling an incident.

Prioritising identities and configurations

Asked about the greatest cloud security risks for the following twelve months, 77 percent named identity and access. Misconfigured cloud services followed at 70 percent and data exposure at 66 percent. These figures describe the concerns of respondents and do not represent a measured distribution of successful attacks.

To prioritise, teams can examine one concrete connection: which identity has access to an exposed resource and which data resides there? Such a check combines permissions, configuration and data holdings into an actionable case. Ownership and deadlines for remediation should be clearly defined as part of this.

Reviewing automation and platform choice

37 percent of respondents described their automation as basic and geared towards alerts and recommendations. 11 percent reported fully autonomous remediation workflows. For operations, it is advisable to start by testing clearly delineated measures with approvals and rollback options. Whether an automated change is appropriate depends on its effect on the service in question.

If starting from scratch, 64 percent of respondents said they would probably or certainly choose a single-vendor platform combining network, cloud and application security. This is a preference stated in a study funded by the security vendor Fortinet. On its own, it does not demonstrate an advantage of any particular procurement model. When making a choice, teams should check whether existing systems can be integrated and whether data remains available for investigations.

Frequently Asked Questions

Who is behind the Cloud Security Report 2026?

Cybersecurity Insiders produced the report. Fortinet funded it as sponsor. The online survey of 1,163 IT and cybersecurity professionals took place in late 2025.

Does the report prove that higher budgets do not improve security maturity?

No. The study captures budget expectations and self-assessments of maturity. From these findings alone, neither a cause nor the effect of later investments can be inferred.

Is a switch to a single-vendor platform advisable?

The survey captures a hypothetical preference and does not compare the effectiveness of different architectures. Coverage, integration, available data and operational requirements are among the factors that matter for the decision.