Report | Cloud Security Report, 2025 | Check Point Software
Report | Cloud Security Report, 2025
CISO Priorities for Securing the Modern Cloud2025CLOUD SECURITY REPORT
CHECKPOINT | 2025 CLOUD SECURITY REPORT2 ©2025 Cybersecurity Insiders. All Rights Reserved.In today’s interconnected world, network security is essential for every aspect of our digital lives. Organizations face a significant challenge in securing branch offices, data centers, cloud deployments, SaaS applications, mobile users, and email communications more effectively in the AI age.At Check Point, we provide a unique hybrid mesh architecture with over 250 third-party integrations which boosts flexibility by allowing direct connections between cloud services and data centers, resulting in enhanced security, reduced latency, and improved performance. Below follows some guidance on how organizations can protect their cloud infrastructure, and reduce cloud expenses, which continue to soar year-after-year.• Consolidate Fragmented Tools into Unified Security Platforms: Consider solutions with a unified console that simplifies feature discovery and dashboard navigation, supported by a cloud-based platform for agility, scalability, and uninterrupted operations• Gain Visibility Across Cloud Environments: Focus on tools that enhances visibility via consolidated logging, monitoring, event management, and forensics, aiding compliance and bridging security gaps• Leverage AI Defensively to Counter AI-Driven Threats: By integrating automation, AI, and ML, hybrid mesh enhances security teams’ scalability, enabling faster and more effective responses to potential threats while optimizing resource utilizationCISOs today are no longer just defenders—they are strategic enablers of cloud innovation. To protect what’s next, they must move beyond patchwork security toward unified, intelligent, and automated defenses. In the race between speed and safety, real-time readiness is the only path forward.A Message from the Global CISO at Check PointDeryck Mitchelson, Global CISO at Check Point Software Technologies
CHECKPOINT | 2025 CLOUD SECURITY REPORT3 ©2025 Cybersecurity Insiders. All Rights Reserved.OverviewCloud architectures are evolving faster than most security teams can adapt. As hybrid, multi cloud, edge, and SaaS adoption accelerates, organizations are contending with fragmented environments, inconsistent controls, and expanding attack surfaces. Detection is delayed, tooling is overloaded, and many defenses remain outdated—all while adversaries automate, adapt, and scale their own capabilities. The result is a growing mismatch between how the cloud is being used and how it’s being secured.To better understand how security leaders are responding to these pressures, Cybersecurity Insiders set out to examine the real-world strategies, priorities, and constraints shaping cloud defense today. Through a comprehensive survey of over 900 CISOs, cybersecurity professionals, and IT decision-makers conducted in early 2025, this report captures the current state of cloud security from the CISO’s perspective — including what’s working, what’s breaking down, and where organizations are investing next.Key Findings Include:• Cloud adoption is accelerating across every architectural layer— especially hybrid, multi-cloud, and edge — but security strategies have not kept pace. 62% of organizations expanded cloud-edge technologies (like SASE), 57% expanded hybrid cloud, and 51% adopted multi cloud, fragmenting environments and overwhelming traditional perimeter-based defenses.• Cloud-related breaches are rising fast, and many still go undetected for hours or even days. 65% of organizations experienced a cloud-related incident in the past year; only 9% detected it within the first hour, and 62% took more than 24 hours to remediate it.• Detection tools fail to surface threats — users, audits, or third parties discover most incidents. Only 35% of organizations detected incidents via security monitoring tools; most incidents are discovered by end users, third parties, or during audits, exposing critical gaps in real-time threat visibility.• Security operations are under strain from tool sprawl and alert overload. 71% of organizations use over 10 cloud security tools, and 45% receive over 500 daily alerts, eroding response speed, analyst capacity, and risk prioritization.• AI is rising as a top security priority, but most teams still feel unprepared to defend against AI-powered threats. 68% of organizations say AI adoption is a priority, yet only 25% are confident in their ability to defend against machine-driven attacks like automated evasion and malware.• Application-layer security remains dangerously outdated, leaving APIs and business-critical web assets exposed. 61% still rely on signature-based WAF detection as their primary defense, despite the rise of evasive app-layer threats, and only partial adoption of behavioral and AI/ML-based techniques.These findings reveal a cloud security landscape under pressure — and a clear mandate for change. The following pages unpack the key trends, challenges, and strategic responses shaping how security leaders are adapting to a faster, more fragmented, and more hostile cloud environment.
CHECKPOINT | 2025 CLOUD SECURITY REPORT4 ©2025 Cybersecurity Insiders. All Rights Reserved.Cloud infrastructure is becoming more distributed, dynamic, and difficult to defend. As hybrid and multi-cloud adoption grows, traditional security models built for centralized environments are breaking down.• Cloud edge technologies (62% growth), hybrid cloud (57%), and multi-cloud (51%) are expanding quickly in an effort to enhance business agility and scalability. • Security teams must now protect data, identities, and workloads across decentralized environments with fragmented controls and shifting perimeters. • The shift is driving top challenges like safeguarding high-value assets (43%), difficulties in visibility and detection (40%), and overall management of hybrid/multi-cloud security (38%).Cloud Complexity Outpaces Security01
CHECKPOINT | 2025 CLOUD SECURITY REPORT5 ©2025 Cybersecurity Insiders. All Rights Reserved.As organizations increasingly rely on hybrid architectures, multi-cloud ecosystems, and cloud-edge technologies like SASE, the underlying infrastructure is becoming more fragmented, dynamic, and difficult to secure with traditional approaches.Our data reveals a decisive architectural shift: While multi-cloud environments continue to be an integral part of the process, we see that 62% of organizations report an increased adoption of cloud-edge technologies, and 57% have expanded hybrid cloud deployments. A hybrid approach allows for more control over critical data on-premises, while less sensitive information and resources can be easily scaled up and down in the cloud.Cloud Strategies Reshape RiskHybrid cloud Multi cloudSingle cloudOn-prem/privatecloudCloud edgetechnology (SASE)How has your organization’s use of the following cloud models changed within the past two years? 69%66%61%39%24%24%25%29%38%55%INCREASEDNO CHANGEDECREASED2-year net gain/loss62%57%51%16%3%21%23%10%9%7%This divergence signals a critical inflection point: security teams no longer secure “the cloud” as a centralized perimeter, but a constantly shifting matrix of platforms, providers, and traffic flows that require a solid understanding of both private and public cloud technologies. That fragmentation directly fuels many of the security challenges explored throughout this report, from gaps in threat visibility to inconsistent policy enforcement and growing operational overhead.
CHECKPOINT | 2025 CLOUD SECURITY REPORT6 ©2025 Cybersecurity Insiders. All Rights Reserved.Transitioning to a hybrid cloud model has brought added layers of complexity, with 38% of individuals identifying this as one of their primary cybersecurity challenges. While a hybrid cloud can strengthen security measures, it also presents new risks, particularly if data isn’t properly managed and safeguarded across all environments. According to our survey, 43% of respondents reported that safeguarding high-value digital assets, including proprietary datasets, intellectual property, and customer information, is a top challenge. Close behind, 40% point to enhancing threat visibility and detection across hybrid environments, reflecting persistent blind spots in cloud-native telemetry — the continuous collection of system and activity data used to detect threats — as well as identity-based access patterns and lateral traffic flows. Additionally, this creates complications in identity and access management (IAM) and policy enforcement, as 36% are struggling to secure a widely distributed workforce. Lastly, 35% of our audience finds preventing and responding to security incidents to be a major issue — confirmed by the increased number of security incidents and response times cited in subsequent sections of this report.Defending Data, Identities, and Unseen ThreatsWhat are your organization’s biggest cybersecurity challenges?43%Safeguardinghigh-value assets andintellectual property40%Preventing andresponding tosecurity incidentsSecuring theremote workforce 36%Managing hybridand multi-cloud security38%35%Enhancing threatvisibility and detection
CHECKPOINT | 2025 CLOUD SECURITY REPORT7 ©2025 Cybersecurity Insiders. All Rights Reserved.In cybersecurity, visibility is everything. Most organizations focus on defending their network perimeter— keeping an eye on traffic coming in and going out to stop intrusions. However, the real threat emerges when an attacker successfully infiltrates the network.According to our survey, only 17% of organizations have full visibility into lateral traffic within their cloud environments. The rest either have partial (54%) or no visibility at all (29%), leaving a critical detection gap in the middle of the attack lifecycle. Once inside, adversaries often use legitimate credentials and lateral movement techniques to escalate access and move quietly through infrastructure. When internal traffic patterns go unmonitored, these behaviors often go undetected until serious damage is done.Lateral Movement Remains a Hidden RiskWhat level of visibility do you have into your lateral/east-west traffic?Full visibilityNo visibilitySome visibility17%54%29%Closing this gap requires continuous inspection of east-west or workload-to-workload traffic, identity-aware segmentation policies, and real-time collection of runtime activity data — enabling security teams to detect privilege escalation, suspicious behavior, and cross-environment pivoting as it happens.
CHECKPOINT | 2025 CLOUD SECURITY REPORT8 ©2025 Cybersecurity Insiders. All Rights Reserved.The cloud security challenges organizations face are well known. However, the real reasons those challenges persist — and why even the most well-resourced security programs fail — are internal limitations in skills, integration, and architectural execution.The most widely cited barrier is the pace of technological change (54%), which continues to outstrip security teams’ ability to operationalize controls and enforce policies across dynamic environments. Nearly half (49%) report a shortage of skilled personnel, especially professionals with cross-domain knowledge spanning security operations, automation, and AI. Tool fragmentation compounds the problem: 40% of respondents cite poor integration between platforms, resulting in blind spots, inconsistent policies, and sluggish remediation. Other issues include budget constraints (33%), data overload (31%), supply chain vulnerabilities (28%), and organizational silos (25%) that limit visibility and slow coordination across teams.Why Security Strategies Fall ShortWhich of the following barriers inhibit your organization from adequately defending against cyber threats? Rapid technologicalchangesLack of skilled personnelPoor integrationand interoperabilityInsuicient budgetOverwhelming datavolume to analyzeSupply chainvulnerabilitiesLack of collaboration/organizational silos54%49%40%33%31%28%25%These are not just operational annoyances but structural weaknesses that attackers exploit. Before discussing better detection, faster response, or smarter automation, we must acknowledge the internal complexity that keeps many organizations stuck. The next chapter shows what happens when these internal cracks become external failures.
CHECKPOINT | 2025 CLOUD SECURITY REPORT9 ©2025 Cybersecurity Insiders. All Rights Reserved.Rising Security Incidents02Cloud-related breaches are rising sharply, and most organizations are detecting them late, remediating them slowly, and discovering them reactively.• 65% of organizations reported a cloud-related incident in the past 12 months, up from 61% the year before.• 38% take more than 24 hours to detect an incident, and 62% need another full day or more to fully remediate.• Only 35% discovered incidents through their security tools; the rest relied on users, audits, or third parties.
CHECKPOINT | 2025 CLOUD SECURITY REPORT10 ©2025 Cybersecurity Insiders. All Rights Reserved.Despite years of investment in cloud security tools and strategies, incident rates are climbing, exposing an incongruence between modern cloud environments and the defenses meant to protect them.Our survey reveals that 65% of organizations experienced at least one cloud-related security incident in the past 12 months, up from 61% the year prior. This surge shows attackers are exploiting misconfigured assets, identity governance gaps, and inconsistent enforcement across multi-cloud and hybrid deployments. The same complexity that promised agility is now eroding security visibility, fragmenting monitoring data, and slowing response — giving adversaries more room to operate undetected. Cloud Security Incidents are EscalatingHas your organization experienced any security incidents related to cloud usage in the last 12 months? NONot sure/can’t disclose14%21%YES65%Every attack — whether exploiting a zero-day vulnerability, moving laterally, or exfiltrating data — ultimately traverses the network and application layers. By shifting focus to real-time traffic inspection, threat prevention, and AI-driven enforcement at the transport, network, and application layers, organizations can move beyond passive risk detection to proactive breach prevention.
CHECKPOINT | 2025 CLOUD SECURITY REPORT11 ©2025 Cybersecurity Insiders. All Rights Reserved.In many cases, cloud security incidents are not discovered by monitoring systems but by end users, external parties, or during routine audits. This reliance on human and third-party reporting reveals a systemic weakness in how cloud threats are detected today.Only 35% of respondents in our survey said that their cloud security tools were the first to detect a breach. The remaining 65% discovered incidents through indirect or delayed sources: 23% were flagged by affected users, 12% during incident response investigations, 10% via external notifications, and 9% during routine audits. Detection Remains Largely ReactiveHow did you first discover the incident?Security monitoringtools detected itAected usersreported itIncident responseinvestigationExternalnotification 35%23%12%9%10%RoutinesecurityauditOther 11%These numbers suggest that most organizations cannot confidently rely on their existing threat detection stack to surface active attacks. Delayed or missed discovery increases dwell time, complicates remediation, and undermines the perceived reliability of controls that security teams depend on. The core issue isn’t a lack of tools — it’s failure to correlate various sources of data, detect behavioral anomalies, and continuously monitor cloud attack surfaces with real-time intelligence. Fixing this requires more than tuning alert thresholds. Today’s cloud security must extend beyond access control to secure traffic in all directions and across all layers. Only by embedding inline prevention at every ingress and connection point can we eliminate blind spots and prevent attackers from reaching sensitive systems.
CHECKPOINT | 2025 CLOUD SECURITY REPORT12 ©2025 Cybersecurity Insiders. All Rights Reserved.Cloud environments pose more risk than any team can realistically mitigate in a timely manner. Vulnerabilities, misconfigurations, and excessive permissions continue to emerge while exploitation timelines shrink to minutes, leaving teams with an impossible race between detection and compromise.The survey reveals that only 9% of organizations detected a cloud-related incident within the first hour. Just 48% caught it within the first 24 hours, 38% took longer than a full day, and 14% weren’t sure how long it took. These numbers reveal more than a visibility gap: they expose the operational cost of disconnected security data streams, non-correlated alerts, and missing context. In fast-moving cloud environments, where attackers can escalate privileges and pivot laterally within minutes, delayed detection turns small intrusions into multi-system compromises.Delayed Detection Widens the Blast RadiusHow long did it take to detectan incident? Not sure 14%38%9%21%18%< 1 hr1-12 hrs12-24 hrs1-7 days1-4 weeks+1 monthoforganizationssay it takesmorethan24 hourstodetect an incident 15%10%13%In order to eliminate the delay between detection and containment, there needs to be an immediate, coordinated response across the entire ecosystem, including both cloud and enterprise environments. This can be accomplished by decentralizing security and network architecture where security controls and policy enforcement are embedded directly into distributed network nodes—across edge devices, branches, clouds, and data centers—while still integrating with centralized services as needed. This way a threat identified in one area or account can trigger policy adjustments across the entire organization, effectively stopping attackers on a global scale.
CHECKPOINT | 2025 CLOUD SECURITY REPORT13 ©2025 Cybersecurity Insiders. All Rights Reserved.Detecting a breach is only the first hurdle. For most organizations, resolving the incident — restoring systems, validating integrity, and neutralizing lateral spread — takes far longer than it should.Only 6% of organizations in our survey remediated a cloud-related incident within the first hour. Just 30% closed the incident within 24 hours, while 62% took longer — with many lacking automated rollback, policy revalidation, or real-time containment capabilities to accelerate recovery. These delays are rarely due to technology alone. Manual handoffs between teams, inconsistent controls across environments, and limited runtime visibility all contribute to slower response, giving attackers more time to escalate access, pivot across workloads, and exfiltrate sensitive data. In dynamic multi-cloud ecosystems, where assets interconnect and change frequently, every hour of remediation delay expands dwell time, business disruption, and forensic uncertainty.Slow Remediation Extends Risk ExposureHow long did it take to remediatean incident? < 1 hr1-12 hrs12-24 hrs1-7 days1-4 weeks+1 monthNot sure 8%62%6%14%10%oforganizationssay it takes more than 24 hoursto remediatean incident21%18%23%Given the understaffing and skill gaps in both cloud and security teams, organizations must eliminate the need for human intervention in threat response. To accomplish this, threat containment must be automated to prevent attacks from escalating. This entails making immediate adjustments to security policies, automatically isolating compromised systems, and updating firewall rules on the fly to block ongoing threats. Furthermore, automation should not be limited to cloud environments but should also integrate with on-premises security measures, VPN access policies, and third-party security tools. This comprehensive approach ensures cohesive security management across the enterprise, with real-time updates to network and access controls to stop threats before they cause harm.
CHECKPOINT | 2025 CLOUD SECURITY REPORT14 ©2025 Cybersecurity Insiders. All Rights Reserved.Cloud security spending is rising — not just in dollars, but in time, complexity, and burnout. Tool sprawl and staffing inefficiencies are draining resources without improving outcomes.• 71% of organizations use more than 10 tools to secure their cloud environments, and 16% use more than 50.• 89% say the cost of managing cloud security across multiple providers is moderately to extremely significant.• The challenge isn’t just consolidation — it’s integrating tools that share intelligence, reduce redundancy, and support consistent policy enforcement.The Hidden Cost of Cloud Complexity03
CHECKPOINT | 2025 CLOUD SECURITY REPORT15 ©2025 Cybersecurity Insiders. All Rights Reserved.Scaling security across multiple clouds has introduced a cost paradox: as coverage expands, so do financial overhead and complexity — fueled by disconnected tools, parallel staffing, and platform-specific training requirements.According to our survey, 89% of organizations rate the cost of managing cybersecurity consistently across cloud environments as moderately to extremely significant. A combined 48% rate it as very or extremely significant, reflecting the real impact of licensing duplication, redundant tooling, and siloed security processes. Instead of achieving economies of scale, many teams are forced to maintain specialized skills for each cloud provider and security tool, support overlapping systems, and manage inconsistent policies — all of which increase the cost of both technology and human capital. These inefficiencies are compounded by constant context-switching across consoles, vendors, and workflows, draining analyst capacity and reducing strategic visibility.Fragmentation Drives Up Security Costs & ComplexityHow significant is the cost overhead (tooling, staffing, training) of managing cybersecurity consistently across multiple clouds?VerysignificantSlightlysignificantModeratelysignificant14%34%41%7%NotsignificantExtremelysignificant4%organizations rate the cost of managing security as moderately to extremely significant89% Solving this problem requires more than budget reallocation. Organizations need to simplify the operating model itself — consolidating threat prevention, policy enforcement, and security training within a unified framework that lowers overhead and drives consistency across every cloud, workload, and identity.
CHECKPOINT | 2025 CLOUD SECURITY REPORT16 ©2025 Cybersecurity Insiders. All Rights Reserved.In an effort to secure every layer of the cloud stack, most organizations have accumulated dozens of point solutions — often deployed in response to specific threats or compliance demands, rather than deliberate strategic design. The result is a fragmented toolset that increases overhead, slows detection, and reduces overall effectiveness.Our survey shows that 71% of organizations use more than 10 security tools to protect their cloud environments, with 16% using more than 50 tools! This dramatic sprawl leads to duplicated alerts, inconsistent policy enforcement, and siloed visibility across networks, workloads, and applications. It also creates operational friction: normalization of monitoring data breaks down, configuration changes cause unintended conflicts, and SIEM/SOAR pipelines become overloaded with uncorrelated signals. Analysts often spend more time managing tools than managing threats.Tool Sprawl Weakens Cloud DefenseHow many different security tools does your organiz ation use to secure its entire c lo ud envir onment? 1-10tools11-25toolsNot sure 5%26-50tools51-100tools+100tools24%36%19%12%4%of organizations use more than 10 securitytools to protect their cloud environments71%
CHECKPOINT | 2025 CLOUD SECURITY REPORT17 ©2025 Cybersecurity Insiders. All Rights Reserved.The volume of alerts flowing in from disconnected tools, often with overlapping or redundant signals, is interfering with the ability to focus on and prioritize alerts. And that’s exactly when things slip through the cracks.Our survey shows that almost half of organizations receive at least 500 security alerts per day. One in four report over 1,000 alerts daily, with 4% handling more than 10,000 — a deluge of alerts that makes it nearly impossible to prioritize threats in real time. Only 19% report receiving fewer than 50 alerts a day. Without correlation, enrichment, and context, alert volume becomes a liability, increasing the likelihood of missed threats, delayed triage, and burnout among response teams.Tool Fatigue Leads to Alert FatigueHow many security alerts does your security team receive on an average day?of security teamsreceive 500 or morealerts per day500-999 alerts1,000-4,999 alerts5,000-9,999 alertsNot sure 8%+10,000 alerts45%<50 alerts50-499 alerts19%28%20%14%7%4%WARNINGTraditional approaches focus on identifying risk by scanning workloads, code, and configurations in search of vulnerabilities before attackers find them. However, this creates alert fatigue, drains security resources, and still leaves environments vulnerable to zero-days and rapidly evolving exploits. Worse, it places undue security enforcement burden on developers and DevOps engineers, whose primary focus is not threat mitigation. What’s needed is defense in depth, not defense in sprawl: a unified, intelligent architecture that consolidates enforcement across layers and environments without relying on a dozen disconnected point products or siloed teams. All attacks traverse the network and application layers. That is where proper protection must live — inline, autonomous, and operated by the security team. Prioritize security solutions that share intelligence and enforce policies together, both in house and with other vendors in the market, to create an ‘open garden’ platform.Finally, even with a super-tuned system that presents analysts with a package of alerts, they still need to investigate, understand, and come to conclusions. This is where automating AI and machine learning can give security teams that added layer of insight and protection.
CHECKPOINT | 2025 CLOUD SECURITY REPORT18 ©2025 Cybersecurity Insiders. All Rights Reserved.AI Security Modernization04AI is rapidly becoming a core security priority — but defenders still feel outpaced by AI-powered threats and blocked by implementation challenges.• 68% of organizations rank AI adoption as a cybersecurity priority, yet only 25% feel confident defending against AI-driven attacks. • Only 43% have adopted AI/ML-based WAF capabilities, while 61% of organizations primarily use signature-based WAF detection. These results reflect a slow shift toward modernization, but the dominance of static models leaves application and API surfaces vulnerable to fast-moving attacks. • Top AI adoption barriers include lack of skilled personnel (62%), integration friction (56%), and limited model explainability (32%).
CHECKPOINT | 2025 CLOUD SECURITY REPORT19 ©2025 Cybersecurity Insiders. All Rights Reserved.After years of battling alert overload, signal noise, and delayed incident response, security leaders are no longer treating AI as optional. It’s becoming a top priority for scaling detection and automating defense in cloud environments that now move faster than humans can manage.Up from 54% last year, 68% of organizations now rank AI adoption as a cybersecurity priority — including 21% (13% in 2024) who say it’s their top initiative. This shift reflects a clear mandate: legacy detection models and human-driven triage can’t scale to meet modern cloud threats. AI-powered techniques — from behavioral modeling and anomaly scoring to automated correlation and predictive threat identification — offer a way to reduce alert volume, surface high-risk activity faster, and trigger faster containment actions.AI Rises as a Security Priority6%Low/not a priorityHow does AI adoption rank among your organization’s cybersecurity priorities? of organizationsnow rank AI adoptionas a cybersecuritypriority68% 47%High priority21%Top priority26%Medium priorityUp from 54% last yearReal impact depends on more than adopting AI tools. Organizations must embed AI into their operational workflows, ensuring it can access real-time activity data across workloads, analyze behavior in the moment, and trigger precise response actions across detection systems, identity layers, and workload protections — without adding complexity or added vulnerabilities to already overburdened teams.
CHECKPOINT | 2025 CLOUD SECURITY REPORT20 ©2025 Cybersecurity Insiders. All Rights Reserved.Despite prioritizing AI for their own defenses, most organizations feel under-equipped to handle the wave of attacks powered by adversarial machine learning and automated decision engines.Only 25% of organizations feel confident in their ability to defend against AI-powered threats. The rest cite growing concern over malware, automated evasion tactics, AI-generated phishing, and synthetic identity creation — attack types that adapt in real time and bypass static defenses with ease. This gap in capability is growing wider: defenders are still working within human-paced investigation and rule tuning, while AI-enabled attackers automate reconnaissance, payload mutation, and target selection in seconds.Most Organizations Feel Unprepared for Adversarial AIHow confident are you in your organization’s ability to defend against AI powered cyber attacks? 75%of organizations havelow confidence that they can defend againstAI cyber attacks19%23%33%Veryconfident16%9%ExtremelyconfidentModeratelyconfidentSlightlyconfidentNot confidentBridging this gap requires defense strategies that can match machine-speed threats with machine-speed response, delivering visibility, risk assessment, and real-time data loss prevention across the entire cloud infrastructure. This will reduce the time needed for security tasks, such as threat hunting, analysis, and resolution, driving toward a goal of true autonomous zero trust.
CHECKPOINT | 2025 CLOUD SECURITY REPORT21 ©2025 Cybersecurity Insiders. All Rights Reserved.Cloud applications rely on APIs and web interfaces as their primary communication channels, making the Front Door (Internet Edge) the most exposed attack surface in the cloud. Despite these growing threats, many organizations still rely on legacy WAF detection models that struggle to keep up with evasive and dynamic AI-powered attack techniques.According to our survey, 61% of organizations primarily use signature-based detection in their WAFs — a method well suited for known exploits, but easily bypassed by polymorphic payloads, logic-based attacks, and API abuse. This is followed by 56% that have adopted behavioral analysis to detect abnormal usage patterns and 54% that integrate cloud-based threat intelligence to stay current with emerging threats. Nearly half (49%) use rate limiting and bot mitigation to defend against credential stuffing, scraping, and inventory hoarding, while 43% apply AI/ML-driven techniques to detect previously unseen attacks.WAF Strategies Slowly Shift Toward AIWhich detection and protection methods does your Web Application Firewall (WAF) primarily use? 49%43%Rate limitingand bot mitigationAI/ML-drivendetectionWe do notuse a WAFCloud-based threatintelligence54%61%BehavioralanalysisSignature-baseddetection56%8%These trends indicate a slow uptick in the usage of AI-driven WAF technology, but they also highlight a significant shortfall in signature-based methods. Today’s attacks employ sophisticated methods and protocols to avoid detection; for instance, Log4j had seven different attack methods. Signature-based WAF rules are often either too narrow, missing emerging threats, or too broad, causing false positives and requiring many exceptions for the application to function properly. This is a very labor-intensive process.Without prior knowledge of an attack’s characteristics, it is impossible to create an effective signature for zero-day attacks. This leads to missed attacks and an abundance of false positives. To stay ahead, WAF strategies must incorporate AI/ML driven detection with API discovery and schema validation that give full visibility into API state. This is the only way to predict and prevent zero-day attacks.
CHECKPOINT | 2025 CLOUD SECURITY REPORT22 ©2025 Cybersecurity Insiders. All Rights Reserved.Organizations may be prioritizing AI — but their ability to implement it effectively is being held back by fundamental gaps in people, process, and architecture.According to our survey, the top implementation challenge is a shortage of skilled personnel (62%), especially professionals who understand both AI models and real-world security operations. Integration friction follows closely (56%), as many teams are still working with legacy stacks that lack the interfaces, data flow access, or orchestration capabilities to support AI-driven detection and response. Nearly half (49%) cite high implementation costs, while 38% struggle with excessive false positives and 32% lack confidence in how AI models make decisions — a major hurdle in operationalizing AI without explainability or traceability. Compliance and governance issues (28%) and overdependence on third-party AI tools (23%) round out the picture.AI Roadblocks Reveal Gaps in Talent, Trust, and IntegrationLack of skilledpersonnelWhat are the top challenges your organization has faced trying to implement AI/ML into your security operations? 62%Integration withexisting infrastructure56%High implementationcosts49%AI model explainabilityand trust32%Regulatory andcompliance concerns28%Overdependence onthird-party AI tools23%False positivesand alert fatigue38%AI is the most valuable tool for analyzing, detecting, preventing, and predicting threats. Security teams need to invest in platforms that can aggregate and analyze large-scale activity data alongside millions of indicators of compromise (IOCs). Look for solutions that are being fueled by massive amounts of connected networks and end point devices that are closely monitored by research teams throughout the world. This ability to synchronize IOCs across all enforcement points is crucial in maintaining security and mitigating threats in real time.
CHECKPOINT | 2025 CLOUD SECURITY REPORT23 ©2025 Cybersecurity Insiders. All Rights Reserved.Turning Insight into Action: Cloud Security Priorities for 2025The following priorities reflect what security leaders across industries are focusing on to close the gap between cloud complexity and effective defense.Architect security for a decentralized cloudAs hybrid, multi-cloud, and edge adoption accelerate, static security models collapse under the complexity. With 38% citing hybrid complexity as a top challenge, teams must shift to a more distributed security approach that supplies security where it’s needed, when it’s needed. Network security is more crucial than everOnly 17% of organizations have full visibility into east-west traffic, giving attackers space to move undetected. Embed real-time inspection and lateral movement detection directly into cloud workloads — not just at the perimeter.Break the alert fatigue cycleAlmost half of teams (45%) are flooded with 500+ alerts per day, making it harder to spot real threats. Apply a hybrid mesh layer that connects and automates the entire ecosystem, transforming alerts into real-time action and eliminating the delay between detection and containment. Integrate before you consolidate71% of organizations use over 10 tools, but 40% still struggle with poor interoperability. Prioritize security solutions that share intelligence and enforce policies together— both in house and with other vendors in the market to create an ‘open garden’ platform.Use AI to accelerate defense, not just analyticsWhile 68% prioritize AI adoption, only 25% feel confident defending against AI-powered attacks. To ensure the safe use of powerful AI tools look for a solution that provides comprehensive security and compliance features, specifically designed to manage the unstructured and conversational nature of GenAI prompts. Modernize app-layer defenses before attackers doWith 61% still relying on signature-based WAFs, APIs and apps remain exposed to evasive attacks. Shift to WAF strategies that use AI/ML to detect behavior anomalies, adapt to new attack patterns, and secure traffic across APIs and microservices.123456The best practices outlined here aren’t just smart — they’re grounded in the frontline experience of the security leaders who contributed to this report. Their message is clear: securing the cloud in 2025 means simplifying what’s become unmanageable, automating where humans can’t keep up, and aligning architecture, identity, and threat prevention into one coordinated defense strategy.
CHECKPOINT | 2025 CLOUD SECURITY REPORT24 ©2025 Cybersecurity Insiders. All Rights Reserved.Financial ServicesProfessional ServicesRetail Technology, Software & ElectronicsHealthcare, Pharmaceuticals & BiotechCAREER LEVEL27%23%19%9%6%4%12%39%26%13%9%5%3%5%2%4%11%23%31%29%SpecialistManager/SupervisorDirectorCTO, CIO, CISO, CMO, CFO, COOConsultant Owner/CEO/PresidentOtherDEPARTMENTIT OperationsIT SecurityDevOpsEngineeringOperationsSecOpsOther21%18%14%9%8%6%5%4%15%INDUSTRYManufacturingTelecommunicationsOtherGovernmentCOMPANY SIZE10-99 100-499 500-999 1,000-4,999 5,000–9,999 Over 10,000Reuse of content We encourage the reuse of data, charts, and text published in this report under the terms of this Creative Commons Attribution 4.0 International License. You’re free to share and make commercial use of this work as long as you attribute the report as stipulated in terms of the license. For example: “2025 Cloud Security Report by Cybersecurity Insiders and Checkpoint.”Methodology and DemographicsThis cloud security survey was conducted in early 2025 and gathered responses from 937 cybersecurity professionals across a wide range of industries and organization sizes. Respondents included CISOs, cloud architects, security analysts, and IT leaders responsible for securing hybrid, multi-cloud, and SaaS environments. A stratified sampling approach ensured balanced representation across roles and segments, yielding a 95% confidence level with a ±3.2% margin of error to ensure valid industry representation. Some questions used a “select all that apply” format, so some totals exceed 100% — reflecting the overlapping, multi-dimensional nature of modern cloud security challenges.
https://protect.checkpoint.com/v2/https://www.cybersecurity-insiders.com/.YzJlOmNwYWxsOmM6bzoyZWIwOTBjMTZlYWZhYTE4NTA2MzVlMTM1NjIwYzg5Mzo2OjZmYzk6OTA1YjhiN2M2MmNiODQyNGMzYjVhMTZkNmY1ODQyNmUwMjRhNmMyZmE2NWM3YTEwN2IzYjU0NTZhMWY5NDlmODpwOlQ6Tghttps://protect.checkpoint.com/v2/https://creativecommons.org/.YzJlOmNwYWxsOmM6bzoyZWIwOTBjMTZlYWZhYTE4NTA2MzVlMTM1NjIwYzg5Mzo2OjliN2E6NmJkNzBkZWZkYWJhMGZkYTg0MGEyNDU2M2ZjNTkwMjNjNWVhZDQ2M2E4ODc2YzRiMjc4NGE3ZTFkODQwMzk2MjpwOlQ6Tghttps://protect.checkpoint.com/v2/https://creativecommons.org/.YzJlOmNwYWxsOmM6bzoyZWIwOTBjMTZlYWZhYTE4NTA2MzVlMTM1NjIwYzg5Mzo2OjliN2E6NmJkNzBkZWZkYWJhMGZkYTg0MGEyNDU2M2ZjNTkwMjNjNWVhZDQ2M2E4ODc2YzRiMjc4NGE3ZTFkODQwMzk2MjpwOlQ6Tg
Check Point Software Technologies Ltd. checkpoint.com is a leading protector of digital trust, utilizing AI-powered cyber security solutions to safeguard over 100,000 organizations globally. Through its Infinity Platform and an open garden ecosystem, Check Point’s prevention-first approach delivers industry-leading security efficacy while reducing risk. Employing a hybrid mesh network architecture with SASE at its core, the Infinity Platform unifies the management of on-premises, cloud, and workspace environments to offer flexibility, simplicity and scale for enterprises and service providers.www.checkpoint.com
https://protect.checkpoint.com/v2/https://www.checkpoint.com/?utm_content=press-release.YzJlOmNwYWxsOmM6bzoyZWIwOTBjMTZlYWZhYTE4NTA2MzVlMTM1NjIwYzg5Mzo2OmZmYzA6YzU1Yzc3ODJjYzhkMTNmYjcxOTc1Mzg4YmEyNGNhYzY2NzU0NjlkNGE0NTE2ZDc4NzhjNjFjMzgyMGQxYzQwZTpwOlQ6Tghttps://protect.checkpoint.com/v2/https://www.checkpoint.com/.YzJlOmNwYWxsOmM6bzoyZWIwOTBjMTZlYWZhYTE4NTA2MzVlMTM1NjIwYzg5Mzo2OjU3YjY6ODRmMGI4YzU4YWRkNGM3Y2U4YmQ0N2Q0YTJiYTVhYTYwNGNiYTUyMTIyN2YwZmIyYjUzNWQ4NDMyZTMxOTBjMTpwOlQ6Tghttps://protect.checkpoint.com/v2/https://www.checkpoint.com/.YzJlOmNwYWxsOmM6bzoyZWIwOTBjMTZlYWZhYTE4NTA2MzVlMTM1NjIwYzg5Mzo2OjU3YjY6ODRmMGI4YzU4YWRkNGM3Y2U4YmQ0N2Q0YTJiYTVhYTYwNGNiYTUyMTIyN2YwZmIyYjUzNWQ4NDMyZTMxOTBjMTpwOlQ6Tg
1 / 26
90%