A new report out today from Thales SA warns that enterprise security strategies are struggling to keep pace with the growing complexity of cloud environments and the accelerating demands of artificial intelligence.

The 2025 Thales Cloud Security Study finds that as organizations expand their reliance on multicloud infrastructure and software-as-a-service applications, security teams are being stretched thin by operational complexity, fragmented tools and the surge in sensitive data flowing through AI systems.

The Thales study specifically points to the increasing convergence of AI and cloud as a major risk amplifier. Issues arise with AI initiatives that rely on vast volumes of cloud-hosted data and yet, many organizations have yet to implement consistent encryption or access controls. Security policies are often misaligned across hybrid environments, while staffing and operational gaps continue to expose sensitive assets to compromise.

The study also involved a survey of nearly 3,200 security and information technology professionals to ascertain what issues are arising with enterprises. Cloud security was found to remain as the top investment priority for enterprises, with 64% of respondents ranking it among their top five concerns. AI security, a new category this year, now ranks second, with 52% of organizations reporting that AI security spending is displacing traditional security investments.

Tool sprawl was also found to be compounding the problem, with the average enterprise using 2.1 public cloud providers and 85 SaaS applications. 61% of respondents reported using five or more tools for data discovery or classification and more than half were found to use multiple encryption key managers, often unique to each cloud provider, creating management silos and increasing the risk of human error.

The study also emphasizes how the risks are not hypothetical as four of the five most-targeted assets in recent cyberattacks are cloud-based. Stolen credentials and secrets were cited as the fastest-growing attack vector by 68% of respondents, yet only 65% were found to have implemented multifactor authentication. Meanwhile, 85% of organizations now say at least 40% of their cloud data is sensitive, up significantly from last year.

“The accelerating shift to cloud and AI is forcing enterprises to rethink how they manage risk at scale,” said Sebastian Cano, senior vice president for cybersecurity products at Thales. “With over half of cloud data now classified as sensitive and yet only a small fraction fully encrypted, it’s clear that security strategies haven’t kept pace with adoption. To remain resilient and competitive, organizations must embed strong data protection into the core of their digital infrastructure.”

Image: SiliconANGLE/Reve