Cloud adoption has always moved faster than security governance. But the latest data suggests the cybersecurity gap is widening—and attackers know it.
Tenable’s Cloud and AI Security Risk Report 2026 highlights a worrying trend across modern infrastructure: organizations are rapidly layering AI services, third-party code packages, and automated Cloud architectures onto environments that were never designed for that level of complexity.
The result is an expanding Cloud attack surface—and a new set of risks that Cloud service providers cannot afford to ignore.
For CSPs, MSPs, and platform providers, security is no longer just about patching servers and tightening firewall rules. It now spans AI identities, software supply chains, dormant credentials, and Cloud workloads that are quietly waiting to be exploited.
Let’s unpack what the data means in practice.
The Cloud attack surface just expanded—again
AI is already embedded in modern Cloud environments. From model training pipelines to AI-driven automation, these services are rapidly becoming part of production infrastructure.
But they also introduce new identity and access challenges.
Tenable’s research found that 18% of organizations have overprivileged IAM roles that AI services can assume. In other words, AI systems may have more permissions than they need—and attackers are exploiting those identities to move laterally across environments.
At the same time:
- 70% of organizations now use at least one AI or Model Context Protocol (MCP) package
- Many default AI execution roles remain inactive but still retain permissions
- Some organizations expose AI-related API keys in Cloud configurations
For Cloud service providers, this highlights a growing operational reality: AI workloads are becoming first-class infrastructure components.
But they are often deployed with the same shortcuts that plagued early Cloud adoption—overprivileged roles, poorly scoped permissions, and forgotten credentials.
CSPs that support customers building AI services will need stronger guardrails around identity governance, especially for non-human identities such as service accounts, automation roles, and AI execution environments.
Because unlike human users, these identities run continuously—and attackers know exactly where to find them.
Supply chain risk is now a Cloud problem
Software supply chain attacks are nothing new, but Cloud infrastructure has dramatically amplified the scale of the problem.
According to the report, 86% of organizations have installed third-party code packages with critical-severity vulnerabilities somewhere in their environments.
Even more concerning:
- 31% of organizations are exposed to critical vulnerabilities at scale
- 13% have deployed packages previously associated with major supply chain attacks
In practice, this means Cloud environments increasingly depend on external code that security teams don’t fully control. And those dependencies are everywhere—AI libraries, DevOps tooling, container packages, automation frameworks, and infrastructure scripts.
For Cloud service providers, this shifts the security conversation from infrastructure hardening to ecosystem risk management.
CSPs must help customers answer difficult questions:
- Which third-party packages are running in production?
- Are those packages vulnerable—or already exploited?
- How quickly can patches be deployed when new CVEs emerge?
Without visibility into the software supply chain, Cloud security becomes reactive, and attackers are exploiting that lag.
The rise of the “dormancy gap”
One of the most striking findings in the research involves what Tenable calls the dormancy gap.
Across Cloud environments analyzed, 49% of identities with critical excessive permissions were inactive. In other words, nearly half of the most powerful identities in many Cloud environments are not even being used. They simply exist—quietly waiting to be discovered and compromised.
These dormant identities often belong to:
- legacy services
- abandoned automation workflows
- old integrations
- temporary testing environments
- forgotten machine identities
The problem becomes even more serious when credentials are involved.
The report found that:
- 65% of organizations have unused or unrotated access keys
- 62% have unused keys tied to identities with excessive permissions
- 58% maintain long-standing credentials that have never been rotated
For attackers, these are ideal entry points. The credentials exist, the permissions are powerful, and no one is watching them—or even remembers they exist.
For Cloud service providers, this creates a major opportunity.
Identity hygiene—decommissioning unused roles, rotating keys, and enforcing least privilege—is one of the fastest ways to reduce risk across Cloud environments. But it requires visibility that many organizations still lack.
External access: convenience meets exposure
Cloud ecosystems rely heavily on third-party integrations. Vendors need access to systems. Partners need API connectivity. External platforms need data pipelines, but those connections also create risk.
The research found that 53% of organizations allow external accounts to assume roles with critical permissions.
In some cases, the exposure is even larger:
- 14% of organizations expose more than 75% of their Cloud resources to external accounts
- 5% allow guest or external users to escalate privileges
For Cloud service providers managing complex environments, this highlights the importance of governance over external access. When a partner or vendor account is compromised, the blast radius can extend far beyond the original entry point.
CSPs that manage multi-tenant environments—or operate shared platforms—must ensure external identities are tightly scoped and continuously monitored. Otherwise, a single compromised vendor account could expose entire infrastructures.
“Sitting duck” workloads are everywhere
Perhaps the most sobering finding in the report concerns Cloud workloads themselves.
Despite years of security awareness, 82% of organizations still run workloads with known exploitable vulnerabilities.
That means attackers do not need sophisticated zero-day exploits. In many cases, publicly documented vulnerabilities are enough.
The report also highlights additional infrastructure risks:
- 79% of organizations run workloads with high-severity vulnerabilities
- 57% operate end-of-life workloads
- Many organizations still rely on legacy virtual machines or outdated container images
In other words, many workloads are effectively “sitting ducks”—easy targets for automated exploitation. The speed of modern vulnerability weaponization makes this especially dangerous: some recent vulnerabilities have been exploited within days of public disclosure, leaving almost no margin for delayed patching cycles.
For Cloud service providers, this reinforces the importance of continuous exposure management rather than periodic security reviews. Security can no longer rely on quarterly audits, since the threat landscape moves far too quickly.
What this means for Cloud service providers
Taken together, these findings point to a fundamental shift in Cloud security.
The biggest risks are no longer just misconfigured storage buckets or open ports.
They now include:
- AI identities with excessive permissions
- vulnerable third-party software dependencies
- dormant credentials with administrative access
- external accounts with broad privileges
- unpatched Cloud workloads running known exploits
For Cloud service providers, the challenge is not simply protecting infrastructure—it is managing complex, interconnected ecosystems. That means security strategies must evolve to focus on visibility and remediation across the entire Cloud stack.
Some priorities stand out.
First, identity governance must extend beyond human users. Non-human identities—AI services, automation scripts, service accounts—are becoming the dominant actors in Cloud environments.
Second, supply chain risk must be treated as infrastructure risk. Vulnerable libraries and packages are now direct attack paths into Cloud systems.
Third, organizations must reduce dormant exposure. Unused roles, keys, and credentials are low-hanging fruit for attackers—and often the easiest risks to eliminate.
And finally, continuous vulnerability management is essential. In a world where exploits appear within hours of disclosure, patching delays can quickly become security incidents.
The Cloud security arms race continues
As the Tenable research shows, the modern Cloud attack surface is not just growing—it is becoming more complex and harder to manage.
For Cloud service providers, the opportunity is clear.
Those that can combine innovation with strong security governance will become trusted partners in the AI-driven Cloud era.
Those that cannot may find their infrastructure becoming exactly what attackers are looking for: a sitting duck.
