33% of business and tech leaders ranked cloud-related threats in their top three threats they are least prepared to address.

Cloud and connected product attacks are the top two cyber threats organisations feel least prepared to address.

Fewer than half of business executives are fully satisfied with the ROI on cloud, automation, and genAI.

2% of business executives view cloud and IT as profit centers.

Cloud misconfigurations and excessive permissions vulnerabilities were found in 42% of cloud environments that were pen tested.

Two new cloud-related techniques - Data from Cloud Storage and Disable or Modify Cloud Firewall - have entered Red Canary's top 10 techniques for the first time.

CrowdStrike OverWatch observed a 40% year-over-year increase in intrusions by suspected cloud-conscious China-nexus actors.

Cloud intrusions increased by 136% in the first half of 2025 compared to all of 2024.

54% of IT leaders in the UK and Ireland lack complete visibility into their cloud spend, which makes it impossible to measure return on investment (ROI).

94% of organisations now operate in hybrid or cloud-first environments.

In one analysis, retail had 23.3% vulnerable cloud assets.

In one analysis, professional services had 28% of vulnerable assets across cloud, APIs, and web applications.

In one analysis, media had 21% of vulnerable assets across cloud, APIs, and web applications.

In one analysis, energy had 18% of vulnerable assets across cloud, APIs, and web applications.

13.6% of all analyzed cloud assets are vulnerable.

In one analysis, transport had 12% of vulnerable assets across cloud, APIs, and web applications.

In one analysis, the services sector had 25% vulnerable cloud assets.

In one analysis, hospitality had 15% of vulnerable assets across cloud, APIs, and web applications.

In one analysis, retail had 27% of vulnerable assets across cloud, APIs, and web applications.

In one analysis, technology had 15% of vulnerable assets across cloud, APIs, and web applications.