AI Security Spend Surges While Traditional Security Budgets Shrink

A new Thales report reveals that while enterprises are pouring resources into AI-specific protections, only 8% are encrypting the majority of their sensitive cloud data — leaving critical assets exposed even as AI-driven threats escalate and traditional security budgets shrink.

The findings come from the recently released 2025 Thales Cloud Security Study, conducted by S&P Global Market Intelligence 451 Research and commissioned by global cybersecurity leader Thales. Published June 30, 2025, the report is based on survey responses from more than 3,100 IT and security professionals across 20 countries, representing a range of industries and organizational sizes. It offers an in-depth look at the evolving state of cloud security — particularly as AI adoption accelerates and hybrid, multicloud infrastructures grow more complex.

“The accelerating shift to cloud and AI is forcing enterprises to rethink how they manage risk at scale,” said Sebastien Cano, senior vice president, Cyber Security Products, at Thales, in a statement. “With over half of cloud data now classified as sensitive, and yet only a small fraction fully encrypted, it’s clear that security strategies haven’t kept pace with adoption. To remain resilient and competitive, organizations must embed strong data protection into the core of their digital infrastructure.”

Most Sensitive Cloud Data Still Left Unencrypted

Despite years of warnings and rising attack volumes, the study reveals that most organizations continue to leave sensitive data in the cloud exposed.

According to the report, only 8% of respondents encrypt 80% or more of their cloud data, even though 85% say at least 40% of their cloud data is sensitive. That’s a sharp disconnect that represents, in Thales’ words, “a manageable risk that organizations should address with urgency.”

The study warns that encryption alone isn’t enough, but without it, data remains vulnerable — especially as attacks grow more access-focused. In fact, 68% of respondents cited credential and stolen secrets attacks as the fastest-growing tactic targeting cloud infrastructure, making encryption a last line of defense when access controls fail.

Cloud Data Encryption Coverage (2025)

In addition to low coverage, organizations also struggle with key management sprawl. The report notes that:

• 57% of respondents are using five or more key management systems (up from 53% last year)
• 48% still manage encryption keys through cloud provider consoles
• Only 28% use “bring your own key” (BYOK) approaches, making it the most common — but still limited — strategy