Enterprises are leaving themselves more vulnerable to attackers as they shift from on-premises workloads to cloud infrastructure, by increasing their “attackable surface area”, a new vendor survey warned last week.

The CloudPassage Inc. study, published on Friday, was based on a poll of IT managers at the recent Black Hat security conference, and found that a massive 94 percent of respondents believe that the shift to the cloud leaves them more exposed. And as server workloads increase, IT managers estimate that the risk factor could increase by as much as 100 times.

The benefits of the cloud, such as agility, scalability and its dynamic nature, are widely viewed as giving companies a clear competitive edge. But at the same time, the increased server workloads necessitate new security solutions as the “attackable surface area” grows in parallel. As a result, some 95 percent of respondents said the cloud shift means they’re having to create, modify or retire server workloads more frequently than they did in traditional on-premises data centers.

As such, a whopping 85 percent of IT security managers said they’re unable to keep up with the pace of server workload changes that the shift to the cloud necessitates. One of the main problems is a lack of automation tools needed to secure and audit cloud server workloads when configuring and deploying them, cited by 85 percent of respondents.

However, the good news is that automation solutions like firewalls and segmentation tools are becoming more common – some 62 percent said they’re already using such tools to secure and audit their cloud workloads.

Another problem with the cloud shift and agile application delivery is more “security management overheads,” CloudPassage reported.

“Organizations rarely increase the size of their security teams at all, much less enough to keep up with the higher scale and pace,” said CloudPassage CTO Carson Sweet in a statement. “While organizations have started to understand that cloud infrastructure can deliver faster development, deployment, and innovation cycles, many are not thinking about the related impact to security operations.”

Security analysts say the gap between developing and deploying applications and the build out of IT infrastructure is steadily shrinking as enterprises shift to the cloud. As such, they argue that security needs to be baked in to cloud infrastructure. CloudPassage’s argument is that the need for security automation is growing, because most respondents said they’re not adding additional security personnel.

Photo Credit: Christoph Scholz via Compfight cc