.png)
AI Threat Readiness Playbook
AI is changing how organizations approach security. As attackers use AI to identify vulnerabilities and accelerate exploitation, security teams need operational strategies that can keep pace.
The AI Threat Readiness Playbook provides a practical, four-pillar framework security leaders can use to strengthen their programs.
Readers will learn how to:
- Reduce critical attack surface exposure
- Improve zero-day response and remediation
- Strengthen application security with AI-assisted analysis
- Modernize detection and response using AI-driven workflows
Cloud-Native & Multi-Cloud Complexity
Cloud adoption has transformed how organizations build and deploy technology, but it has also made security significantly more complex. As cloud-native architectures, dynamic infrastructure and multi-cloud strategies become the norm, maintaining visibility is increasingly difficult. We explore the key security challenges and potential countermeasures, from identity management to asset visibility and shared risk ownership, that help organizations secure modern cloud environments.
Cloud technology has fundamentally changed the way organizations deploy and consume IT services. What once required significant investment in hardware, operating systems, networking and application deployment can now be accomplished in minutes through a cloud management console. This speed and flexibility have accelerated innovation, reduced barriers to entry and enabled organizations to scale at unprecedented levels.
However, the same characteristics that make cloud computing attractive also introduce significant security challenges. The democratization of technology deployment allows individuals with limited cybersecurity expertise to provision resources and launch services rapidly, often without a full understanding of the associated risks. As a result, organizations face growing exposure to misconfigurations, unmanaged assets, excessive privileges and shadow IT.
While cloud computing delivers substantial benefits in resilience, agility and scalability, it also requires a fundamentally different approach to security oversight. Traditional security models were built around relatively static environments with clearly defined boundaries. Modern cloud-native environments, by contrast, are highly dynamic, distributed and constantly changing. As a result, maintaining visibility has become one of the most critical challenges facing security teams today.
The Visibility Challenge
We can only secure what we know about, and we can only know about what we can see. Back in the day we had physical servers – they were in data center racks, they had labels on, they generated noise and heat, and we could literally walk up to them and trace what their network cards were connected to. Then came virtualization – what many people now call “private cloud” – where we spun up a hypervisor and created virtual network switches, virtual network connections and virtual servers. But we still had pretty much full visibility – even if it was one step removed from the physical tin via the hypervisor control app. Even in the early days of the cloud as we now know it, we pretty much just emulated our on-premise private cloud on someone else’s computer.
But now we have containers, serverless functions, infrastructure as code, continuous integration and continuous deployment (CI/CD). These relatively recent developments bring huge complications by making things change dynamically, moving in and out of existence whenever need demands (or, these days, when an AI agent tells them to) and by deploying new versions of applications we’re developing several times a week rather than a handful of times a year. Gaining and then maintaining visibility of such fast-moving and fast-changing concepts is bordering on the impossible, so we need to find a way to manage this problem and to keep up with change. One-off or periodic checks are no longer sufficient.
Multi Cloud Management
Taking matters further, in modern cloud setups some organizations take things a step further by adopting multiple different cloud providers. In the average case – even in technology conservative areas like banking, which have a justified reputation for concern where resilience is in play – we are content to accept the resilience of a single cloud provider. We will spread our cloud services between two of the “regions” in our cloud provider’s infrastructure and configure the setup to switch from one to the other in the event of a failure. Because there is a non-zero chance of a provider having an issue that affects multiple regions, though, some organizations take the step of deploying services across two or more different cloud providers.
This brings a security problem. Two providers means two sets of access management and PAM, more complex configuration to achieve failover in the event of a problem, double the challenge of generating and delivering log files to SIEM or SOAR facilities, two sets of dissimilar security policy engines, and so on. Adoption of multiple clouds brings the theoretical advantage of reducing single-vendor dependency, but the price we pay is that we have a much harder security challenge.
We have established that the cloud complicates security and multi-cloud operation really complicates it. Let us consider, then, what we can do about the security challenge we just mentioned. First, it is safe to assume that there is no way we will simply take the decision to use the cloud less and bring things back on-premise: statistics from June 2026 tell us that this does not seem to be happening anywhere, as cloud adoption continues to grow faster than we could have imagined just a few years ago. With server prices rising thanks to spikes in the price of RAM modules, on-premise servers are becoming unaffordable for many organizations. We therefore need to work with what we have – our public cloud worlds – and do what we can to secure them.
Securing What We Work With
As we wrote previously, securing identity management in our systems is now more important than securing the perimeter, because in the cloud there really is no tangible perimeter anyhow. Effective management of identity security – which includes constantly applying the principle of least privilege, monitoring for over-privileged accounts, access from suspicious places at suspicious times, securing secrets, checking regularly for dormant logins and properly managing service accounts – is an established concept that applies just as well in a multi-cloud setup as in a single-cloud environment, albeit that setting it up in a hybrid environment is a little harder.
Having dealt with the core commonality that is identity, we then need to look for other security activities that are applicable to all our systems, particularly those in the cloud and multi-cloud setups, and address them one by one. Asset management is critical: we can only secure what we know we have. Likewise, configuration: if we can see how things are configured and how the elements of our infrastructure interact, we can use technology to analyze areas for improvement. A good, properly maintained content management database (CMDB) is as significant and important a security tool as any anti-malware or EDR solution. Effective monitoring and management of vulnerabilities is another key inclusion, along with prioritization of fixes based on risk. All of the above are perfectly straightforward to implement in the cloud just as they are in on-premise setups, although – again – multi-cloud is more involved, most of the effort is entirely up-front: once the battle to implement the technology has been won, the business-as-usual element is little or no more involved in multi-cloud as it is in a single cloud.
There is a final element to securing cloud-native and multi-cloud systems that goes back to one of the first points made at the top of the article: while the IT team will happily manage, monitor and patch the underlying cloud services, a solid, trusting partnership between IT and the application owners is essential. Particularly with SaaS applications, the risk of the business teams going off on their own and signing up to services is high. If we can help the people needing and using the systems understand that by working together we can make their life easier whilst also making the systems more secure, everyone wins. This needs proper business ownership of the application usage, which will need us to explain what that means and provide whatever support we can to get them to accept that they are the owner of their part of the risk.
Considering Skills
Addressing these challenges requires professionals who understand not only cybersecurity principles but also the unique architectural, operational and governance considerations of cloud environments. The ISC2 Certified Cloud Security Professional (CCSP) certification provides a framework for developing this expertise, covering areas such as cloud architecture, security operations, risk management, compliance and application security. Organizations increasingly rely on professionals with these specialized skills to help secure cloud-native and multi-cloud environments at scale.
The security challenge presented by cloud-native and multi-cloud environments is not complexity alone. Complexity can be managed through sound governance, automation and operational discipline. The greater challenge is maintaining visibility into systems that change continuously and increasingly operate across multiple platforms.
Organizations that establish strong identity governance, maintain an accurate and continuously updated CMDB, centralize monitoring and detection capabilities, and ensure clear ownership of risk can successfully secure even the most complex cloud environments. The key principle remains unchanged: complexity is manageable, but invisibility is not.
