Cloud Complexity Outpacing Human Defenses, Report Warns

Cloud security teams are struggling less with whether they can secure the cloud and more with whether they can keep up with it, according to the latest Cloud Security Report from Fortinet.

Based on a survey of 1,163 security leaders and practitioners from a range of industries, including technology, financial services, healthcare, and government, the “2026 Cloud Security Trends: Closing the Cloud Complexity Gap” report found that most organizations are operating across hybrid and multi-cloud environments, yet nearly two-thirds lack confidence in their ability to detect and respond to cloud threats in real time. The data points to a widening gap between the speed and complexity of modern cloud environments and the human-led security processes still used to defend them.

That framing represents a shift from a similar 2025 report, “2025 Global Threat Landscape Report,” which emphasized security and compliance as the primary barriers to cloud adoption (see “Cloud Security Threats Expand Beyond Misconfigured Storage Buckets: Report“). In that earlier report, concerns centered on meeting regulatory requirements, protecting sensitive data, and building sufficient governance as organizations expanded their use of hybrid and multi-cloud architectures. While those concerns remain present, the 2026 report reframes the problem as operational rather than transitional, describing cloud complexity as a permanent condition rather than a growing pain.

In the 2026 survey, identity and access security ranks as the top cloud-native risk, cited by 77% of respondents, followed by misconfigured cloud services at 70% and data exposure risks at 66%. Separately, 69% say tool sprawl and visibility gaps are the biggest barriers limiting cloud security effectiveness, reflecting the operational strain created by managing disconnected security controls across multiple cloud providers.

Multi-Cloud as the Default Operating Model

The report confirms that hybrid and multi-cloud architectures are now the norm rather than an intermediate phase. Eighty-eight percent of organizations say they operate across hybrid or multi-cloud environments, with 81% relying on two or more cloud providers to run critical workloads. As cloud environments expand, assets, identities, and configurations change continuously, increasing the attack surface and making consistent visibility more difficult to maintain.