Red Hat Cloud-Native Security Survey Finds Widespread Incidents and AI Governance Gaps
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Red Hat’s 2026 survey of 600 IT professionals found 97% reported cloud-native security incidents in the past year. Only 39% reported a mature security strategy, while 59% lacked documented AI policies.
Key points
- The report draws on 600 online surveys conducted August 25–September 23, 2025, with IT professionals at companies employing at least 100 people.
- Among respondents, 97% reported at least one cloud-native security incident in the previous year; misconfigurations and known vulnerabilities were the leading issue types.
- Security concerns slowed or delayed application deployments at 74% of surveyed organizations, while 92% reported significant business or software-delivery impacts from incidents.
- Only 39% reported a well-defined, mature cloud-native security strategy, despite 56% describing their daily security posture as highly proactive.
- Container image signing and verification adoption stood at 49%, compared with 74% adoption of identity and access management.
- Planned investments emphasized CI/CD security automation, software supply chain security and runtime protection; the report recommends embedding automated guardrails throughout the software lifecycle.
- Although 79% said generative AI creates new cloud security challenges, 59% lacked documented AI policies. Reported concerns included sensitive-data exposure, shadow AI and third-party integrations.
Article Details
- Publisher
- Red Hat
- Report Period
- 2025-08-25 to 2025-09-23
- Scope
- Cloud-native security incidents, governance, automation, software supply chain security, and AI risks across hybrid and multicloud environments.
- Sample Size
- 600 completed online surveys of IT professionals responsible for applications, security, platforms, or development at companies with at least 100 employees.
- Key Statistics
- 97% of surveyed organizations reported at least one cloud-native security incident in the preceding year.
- 74% reported slowing or delaying application deployments because of security concerns in the preceding 12 months.
- 39% reported a well-defined cloud-native security strategy, while 56% described their day-to-day security posture as highly proactive.
- 74% reported using identity and access management, compared with 49% using container image signing and verification.
- 79% agreed that generative AI creates new security challenges in their cloud environments, while 59% lacked documented internal AI usage policies or governance frameworks.
- Recommendations
- Establish a formal cloud-native security strategy and maturity roadmap aligned with business objectives and shared across teams.
- Embed automated security guardrails throughout development and production, including pre-commit checks, Infrastructure as Code scanning, policy enforcement, vulnerability scanning, and continuous runtime monitoring.
- Protect software supply chain integrity through dependency scanning, SBOMs, image and package signing, and enforced provenance checks before production deployment.
- Unify observability and security data across teams, using runtime threat detection insights to prioritize vulnerability remediation during development and builds.
- Establish cross-functional AI governance covering acceptable use, sensitive-data handling, deployment approvals, output monitoring, and developer education.