‘State of Cloud Security Report’: 99% of Organisations Experienced Attacks on AI Apps, Services

The rapid adoption of enterprise AI (Artificial Intelligence) is fuelling an unprecedented surge in cloud security risks. To help organisations understand and counter escalating threats, Palo Alto Networks, the global cybersecurity leader, released its annual State of Cloud Security Report 2025, revealing how AI is driving a massive expansion of the cloud attack surface.

As cloud infrastructure scales to accommodate the influx of AI workloads, it has become a prime target. According to the report, 99% of respondents experienced at least one attack on their AI systems in the past year. At the same time, the rise of GenAI-assisted “vibe coding,” used by 99% of respondents, is producing insecure code faster than security teams can review it. While 52% of teams ship code weekly, only 18% can remediate vulnerabilities at the same pace, allowing unaddressed risks to compound rapidly across cloud environments.

Elad Koren, Vice President of Product Management at Cortex, said about the State of Cloud Security Report 2025: “As organisations aggressively scale cloud investments to power AI initiatives, they are inadvertently opening the door to sophisticated new attack vectors. Our research confirms that traditional approaches to cloud security are inadequate, leaving security teams to fight machine-speed threats with fragmented tools and slow, manual fix cycles. Teams need more than dashboards that highlight risks they can never burn down; they must transform with an agentic-first platform that spans code to cloud to SOC, enabling them to operate faster than the adversary.”

Palo Alto Networks ‘State of Cloud Security Report’ Highlights

Based on a survey of more than 2,800 security executives and practitioners across 10 countries, Palo Alto’s State of Cloud Security Report 2025 outlines several critical AI-driven shifts in cloud risk, including:

• New frontiers of cloud risk: Attackers are rapidly shifting to exploit foundational cloud layers, targeting API infrastructure, identity, and lateral network movement, further straining already overburdened security teams.
• API attacks jump 41%: As agentic AI depends heavily on APIs, their explosive growth has significantly expanded the attack surface, making APIs a primary entry point for advanced threats.
• Identity remains the weakest link: Among respondents, 53% cite lenient identity and access management (IAM) practices as a top challenge, confirming that inadequate access controls are now a leading vector for credential theft and data exfiltration.
• Lateral movement risks persist: Twenty-eight per cent of respondents identify unrestricted network access between cloud workloads as a growing threat, enabling attackers to pivot freely across environments and escalate minor breaches into major incidents.

The Growing Imperative for Cloud and SOC Unification

The State of Cloud Security Report 2025 also found that multivendor complexity and tool sprawl are compounding risk, making the unification of cloud security and security operations centres (SOCs) a strategic necessity.

• Tool sprawl creates blind spots: Organisations manage an average of 17 cloud security tools from five vendors, resulting in fragmented data and context gaps that slow incident response. As a result, 97% of respondents prioritise consolidating their cloud security footprint.
• Siloes slow resolution: Disjointed workflows and isolated data between cloud and SOC teams delay remediation, with 30% of teams taking more than a full day to resolve an incident.
• Cloud and SOC must merge: A strong consensus has emerged, with 89% of organisations agreeing that cloud and application security must be fully integrated with the SOC to be effective.

End-to-End Defence at Machine Speed

As adversaries increasingly weaponise AI to accelerate attacks, static visibility and siloed tools are leaving cloud environments exposed. The State of Cloud Security Report 2025 underscores that staying ahead now requires an end-to-end solution that combines proactive risk reduction with reactive incident response. Addressing this need, Palo Alto Networks Cortex® Cloud™ brings together industry-leading CNAPP and best-in-class CDR in an agentic-first platform that spans code, cloud, and SOC, securing cloud innovation at the speed of AI.

Read the blog and download the full State of Cloud Security Report 2025.