Snyk’s State of Cloud Security Report Reveals 80% of Organizations Have Experienced a Severe Cloud Security Incident in Past Year

Research Also Underscores Risk Is Growing, While Increased Cloud Security Investment Leads to Faster Application Deployment

BOSTON, MA — September 13, 2022 — Snyk, the leader in developer security, today released its State of Cloud Security Report. The findings reveal how today's security professionals and cloud security engineers are grappling with the complex cloud security risks and challenges that have emerged as a result of skyrocketing cloud adoption and increasingly popular cloud-native application development approaches.

At the same time, the research also spotlights the benefits that can result from increased cloud security investment, including stronger incident prevention as well as improved efficiency and cross-team collaboration, leading to faster overall application deployment. Specifically, the report found:

• Four-fifths (80%) of organizations have experienced at least one severe cloud security incident in the past year (such as data breaches, data leaks, and intrusions into their environment);

• 41% of respondents say cloud native services increase complexity, further complicating their security efforts; and,

• Nearly half (49%) of organizations find deployment is faster as a result of improved cloud security.

"This new research should serve as a wake-up call that our collective cloud security risk is universal and will only continue to grow if we double down on outdated approaches and legacy tools," said Josh Stella, Vice President, Chief Architect, Snyk. "The outlook is not entirely dire, however, as the data also clearly reveals that shifting cloud security left and embracing DevSecOps collaboration can allow global organizations to continue their current pace of innovation more securely."

80% Experienced a Severe Cloud Security Incident, Startups and Public Sector Currently Most Impacted

Cloud customers representing organizations of all sizes and industry sectors noted they were impacted by major cloud security events over the last 12 months, with startups (89%) and public sector organizations (88%) most impacted. On the other hand, enterprise companies fared better (most likely due to greater investment), while small and mid-sized businesses (SMBs) reported making out the best (probably as result of a smaller cloud footprint and less infrastructure complexity). 

Respondents specified data breaches, data leaks, and intrusions into their environment were among the most severe incidents they had knowledge of. All of these unquestionably carry a high cost to global businesses, including but not limited to: fines for failed audits and compliance violations, cryptomining on the customer's cloud bill, and loss of productivity due to system downtime.

Tellingly, respondents also indicated this universal risk is likely to grow in the near term. To this end, respondents admitted:

• A quarter (25%) worry they've recently suffered a cloud data breach but are unaware; and,

• The majority (58%) of both security pros and developers believe that the risk of a cloud data breach at their organization will only increase over the next year.

Cloud Native Approach: 41% Cite Additional Complexity as a Trade-Off

While cloud-native application development undoubtedly allows modern developers to move faster to produce more, at the same time, new challenges and complexities have emerged as the overall attack surface has expanded and the clear delineation of security responsibilities has blurred. 

Ultimately, many of today's cloud security failures result from a lack of effective cross-team collaboration and team training. When different teams use different tools or policy frameworks, reconciling work across those teams and ensuring consistent enforcement can be challenging. Moreover, insufficient tooling that produces false positives often leads to alert fatigue within security teams, contributing to human error when identifying the critical issues needed to be prioritized and addressed.

Further, consider:

• 77% of organizations cite problems with poor training and collaboration as a major challenge; and,

• 45% of companies cite demand for engineering resources as the biggest impact of inefficient cloud security.

Strategic Business Results Recognized With Improved Cloud Security: Half See Resulting Faster Deployment

When organizations improve their cloud security, they experience benefits reaching beyond incident mitigation alone.

By fully embracing the cloud to build new applications, teams ultimately can no longer rely on - and therefore let go of - the traditional security approaches and technologies that were designed for legacy environments. Given the realities of cloud-native development and the numerous internal stakeholders involved, businesses that champion and adopt this paradigm shift reap the benefits of increased team collaboration, facilitating enhanced developer productivity and faster secure innovation.

To this end, respondents asserted:

• Infrastructure-as-code (IaC) security delivers a 70% median reduction in cloud misconfigurations;

• Close to half (48%) said their security team is able to do more with the resources they have when cloud security is improved; and,

• 44% said that security improvements have led to better collaboration among teams.

Snyk will be discussing this report's full findings as well as recommended actions to improve cloud security during a number of upcoming events:

• In-person session with Josh Stella at SnykWeek: New York City, taking place Tuesday, September 13 - Thursday, September 15, at PUBLIC Hotel.

• In-person session with Josh Stella at SnykWeek: San Francisco, taking place Tuesday, October 11 - Thursday, October 13, at Parc 55 Hotel.

• Webinar with Drew Wright, "Understanding the State of Cloud Security," taking place Wednesday, September 21, at 1 p.m. ET, to register, visit here.

To further explore these report highlights and interact with the comprehensive findings visit here, and to learn more about Snyk's unique developer-centric approach to cloud security visit here.

About the Report

This report is based on a survey of more than 400 cloud engineering and security practitioners and leaders across various organization types and industries. The survey was conducted in the second quarter of 2022 by Propeller Insights. 

About Snyk

Snyk is the leader in developer security. We empower the world's developers to build secure applications and equip security teams to meet the demands of the digital world. Our developer-first approach ensures organizations can secure all of the critical components of their applications from code to cloud, leading to increased developer productivity, revenue growth, customer satisfaction, cost savings and an overall improved security posture. Snyk's Developer Security Platform automatically integrates with a developer's workflow and is purpose-built for security teams to collaborate with their development teams. Snyk is used by 2,000+ customers worldwide today, including industry leaders such as Asurion, Google, Intuit, MongoDB, New Relic, Revolut and Salesforce.