Thales 2026 Report Highlights AI Data Risks and Cloud Encryption Gaps
Summary
Thales’ 2026 survey of 3,120 IT and security professionals finds growing AI security pressures, incomplete data visibility and cloud protection gaps. Respondents report that an average of 47% of sensitive cloud data is encrypted.
Key points
- S&P Global Market Intelligence 451 Research conducted the Thales-commissioned survey across 20 countries; the observational study makes no causal claims.
- Rapid AI ecosystem change ranked among the top three AI security risks for 70% of respondents; dedicated AI security budgets rose to 30% of organizations from 20%.
- Only 34% reported complete knowledge of where organizational data is stored, and 39% said they could classify all their data, complicating protection as AI agents gain access.
- Cloud storage, cloud applications and cloud management infrastructure remained the top three attack targets. An average of 47% of sensitive cloud data was encrypted.
- Among 988 respondents reporting increased attacks on cloud management infrastructure, 67% cited rising credential theft or compromise, including misappropriated secrets.
- Misconfiguration or human error was the leading reported breach cause at 28%. Organizations averaged seven data protection and monitoring tools, highlighting operational complexity.
- Harvest now, decrypt later was a quantum concern for 61% of respondents; 59% were prototyping or evaluating post-quantum cryptographic algorithms.
Article Details
- Publisher
- Thales
- Report Period
- 2026 edition; survey fieldwork dates not disclosed
- Scope
- Global enterprise survey of security and IT management professionals covering AI, data protection, cloud security, quantum risk and digital sovereignty. Conducted by S&P Global Market Intelligence 451 Research; observational study making no causal claims.
- Sample Size
- 3,120 respondents across 20 countries; organizations screened by annual revenue thresholds.
- Key Statistics
- 30% of surveyed organizations have dedicated AI security budgets, up from 20% in the previous survey; 53% fund AI security through existing security budgets.
- Only 34% of respondents report complete knowledge of where their organization's data is stored, and 39% report being able to classify all their data.
- On average, 51% of cloud data is categorized as sensitive, while 47% of sensitive cloud data is encrypted.
- Among 988 respondents reporting increased attacks against cloud management infrastructure, 67% cited increasing credential theft or compromise, including misappropriated secrets.
- Among 1,998 respondents whose organizations experienced a data breach, 28% identified misconfiguration or human error as the most common cause.
- Recommendations
- Consistently identify, classify and control data across applications, clouds and jurisdictions using a platform approach rather than fragmented controls.
- Carefully evaluate and consolidate security tools to reduce operational complexity while preserving coverage and supporting hybrid and multicloud infrastructure.
- Extend encryption across diverse infrastructure, improve centralized external key control and address emerging quantum computing risks.
- Prioritize development infrastructure, secrets management and data protection when securing AI and agentic applications.
- Define and enforce consistent, understandable data-access policies, and dynamically assess data residency and sovereignty as applications and agents become interconnected.