Study: Increased Cloud Budget Does Not Fill the Security Gap
1,163 security leaders in the 2026 Cloud Security Report cite tool sprawl and complexity gaps as hindering maturity despite rising budgets.
1,163 security decision-makers, one finding: the cloud is growing more complex faster than teams can secure it. The 2026 State of Cloud Security Report by Cybersecurity Insiders (with Fortinet as an industry partner) calls this the Complexity Gap – and delivers numbers that are reshaping budget discussions.
Key Takeaways
- Complexity outpaces maturity. 88 % operate hybrid or multi-cloud environments (up from 82 % last year), and 81 % use two or more providers. Yet 59 % still rate their cloud-security maturity as early or developing.
- Tool sprawl is the top bottleneck. 69 % cite tool sprawl and visibility gaps as their biggest obstacle. 66 % have limited confidence in real-time detection and response.
- Budget alone won’t bridge the gap. 62 % expect cloud-security budgets to rise; on average, they account for 34 % of the total IT-security budget, according to the report. Yet maturity still lags spending.
Related:Flexera 2026: What SMEs Can Actually Adopt / The Cloud Maturity Level SMEs Persuade Themselves They Have
The study is based on an online survey of 1,163 IT and cybersecurity professionals conducted in late 2025 – spanning industries from tech and finance to healthcare and the public sector, and roles from specialists to C-level executives. Published by Cybersecurity Insiders, the report’s industry partner is Fortinet. This is vendor research with a robust sample size, not a lab benchmark. For decision-makers, what matters is less the brand on the cover and more the patterns that remain consistent across multiple chapters.
What is the Cloud Complexity Gap? The Cloud Complexity Gap describes the structural distance between the pace of modern cloud environments and the ability of security teams to maintain real-time visibility, detection, and response. According to the 2026 State of Cloud Security Report, it stems from fragmented tools, scarce specialists, and attackers who scan faster with automation and AI than manual defenses can correlate.
Three Amplifiers, One Operating Model
The report distills the gap down to three reinforcing factors. First, fragmented defenses: tools proliferate with the cloud, often without shared telemetry. Teams manually correlate alerts across systems never designed to work together. 69 % cite this as the top brake on effective cloud security.
Second, understaffed teams: 74 % report an active shortage of qualified security professionals, 77 % express high concern about the industry skills gap. Cloud roles demand expertise in infrastructure, identity, data, and apps simultaneously – precisely the mix that’s hardest to fill. Third, adversaries operating at machine speed: automation and AI detect misconfigurations, permission paths, and exposed data faster than human queues can process them. 66 % lack strong confidence in real-time detect-and-respond capabilities – slightly up from last year (64 %).
The operating model behind this is clearly multi-cloud. 88 % use hybrid or multi-cloud environments, 81 % rely on at least two providers for critical workloads, and 29 % use more than three. Each additional account, SaaS application, and non-human identity expands configurations and data paths. The infrastructure scales automatically – understanding the security posture often does not.
Where Risk Resides – and What the Numbers Mean for Architecture
Risk concentration is hardly surprising – and that’s why it’s actionable. Identity and access lead with 77 %, followed by misconfigured cloud services (70 %) and data exposure (66 %). Workload exploits and supply-chain attacks trail behind. The everyday path runs through permissions, configurations, and data.
This is where the Exposure Chain forms: a misconfiguration opens a resource, an overprivileged identity takes the next step, and sensitive data becomes the target. Posture, identity, and data tools each cover their segment. 77 % prioritize identity – and yet the shared context across the chain is often missing. Attackers automate precisely this correlation.
- Clear priorities among respondents: identity, configuration, data – architectural focus instead of tool shopping
- 64 % would choose a single-vendor platform across network, cloud, and app at a restart
- Success metrics shift to outcomes: fewer misconfigurations, less overprivilege, less alert noise
- Only 11 % report autonomous remediation – automation often stops at the alert
- Only 18 % have AI-powered detection fully operational; 32 % are still in pilot phase
- Always reflect report figures against your own inventory and maturity status
The automation gap is the silent multiplier. 37 % describe automation as largely alert-focused: they find issues but fix them manually. Only 11 % report autonomous remediation without humans in the loop. Meanwhile, many are experimenting with AI in cloud defense, but only 18 % say AI detection is fully operational across their cloud environments. 32 % remain in pilot mode. Attackers don’t need this level of maturity – they already scan, map, and prioritize at machine speed.
What Cloud Teams in DACH Can Derive in Practice
First: spend is not a maturity level. If 62 % are increasing budgets and 59 % still remain in early-stage mode, the bottleneck lies in integration and operating model. Every new point tool without shared context adds operational overhead that the team pays for.
Second: platform consolidation is both a survey signal and an operational priority. 64 % would choose a single-vendor platform “from scratch” across network, cloud, and application security; only 27 % would stick with pure best-of-breed without shared governance. Buyers prioritize coverage and depth (79 %), integration and orchestration (72 %), and automation and compliance (68 %) – before pure usability or price.
Third: outcome metrics replace tool counting. 81 % prioritize security outcomes (fewer misconfigurations, less overprivilege), 76 % operational efficiency (faster detection, less noise), 66 % integration and automation, and 62 % continuous compliance. For platform and security leads, this means aligning roadmaps with exposure reduction and MTTD/MTTR – not with the number of modules purchased.
Fourth: the complexity gap is an architecture and identity issue before it becomes a pure SOC ticket. Teams running multi-cloud need a unified view of permissions, configuration drift, and data paths – or every new AI initiative becomes an additional attack-surface multiplier on an already fragmented foundation.
The report doesn’t provide a DACH-only snapshot or hands-on benchmarks per hyperscaler. But it does deliver a robust sequence: first, context across identity-config-data; then, automation you can trust; finally, AI detection built on that foundation. Reversing that order buys a sense of speed – and keeps the gap open.
Frequently Asked Questions
Who is behind the 2026 Cloud Security Report?
Conducted and published by Cybersecurity Insiders, with Fortinet as an industry partner. The foundation is an online survey of 1,163 IT and cybersecurity professionals conducted in late 2025 across industries and company sizes. It’s industry research with an industry partner – the core metrics (multi-cloud, tool sprawl, identity) are internally consistent and useful for prioritization, but do not replace your own asset and maturity assessments.
What does the Complexity Gap mean for multi-cloud teams?
More providers and SaaS offerings don’t just expand the attack surface – they fragment visibility and policy. When telemetry and rights paths don’t converge, alert volumes grow faster than remediation capacity. The gap is therefore primarily an integration and identity challenge. Pure SOC capacity alone won’t close it.
Should companies switch to a single-vendor platform?
64 % of respondents would plan for this in a greenfield scenario. In practice, this means shared context, unified policy, and less manual correlation – rather than a big-bang migration. What matters most is whether identity, posture, data, and runtime converge into a usable situational picture; the vendor brand is secondary.
Editor's Picks
cloudmagazinFlexera 2026: What SMEs Can Actually AdoptcloudmagazinThe Cloud Maturity Level SMEs Persuade Themselves They’ve AchievedcloudmagazinSovereign Cloud Extends Beyond Server LocationMore from the MBF Media Network
MyBusinessFutureThe Blind Spot of Digitalization Leaders: Why Banks Need AI-Ready DataDigital ChiefsKimi Kills Subscriptions: 7 Checks for AI Capital ExpenditureSecurityTodayOpenAI Models Hacked Hugging Face: What to Verify NowImage source: AI-generated (July 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
