Cloud Security Alliance Issues Top Threats to Cloud Computing Deep Dive 2025

Case studies articulate cloud computing’s most significant and pressing issues

SAN FRANCISCO (RSA Conference) and SEATTLE - April 29, 2025 - The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today issued the Top‌ ‌Threats‌ ‌to‌ ‌Cloud‌ ‌Computing Deep‌ ‌Dive‌ 2025. The report examines eight real-life case‌ ‌studies involving, among others, a multinational technology conglomerate, an Australian sports governing body, a multinational automotive manufacturer, and a cybersecurity technology company, through the lens of last year's Top Threats to Cloud Computing report. 

Drafted by the Top Threats Working Group, each of the breach cases is mapped to applicable Cloud Controls Matrix (CCM) controls and is presented as a threat model accompanied by a detailed, easy-to-reference narrative providing an attack-style synopsis of the malicious actor, spanning the range from threats and vulnerabilities to controls and mitigations.

“The vulnerabilities, threats, and security weaknesses outlined in Top Threats to Cloud Computing 2024 have materialized in real-world breaches, exposing recurring failure patterns and misconfigurations that attackers continue to exploit. By analyzing these incidents, we have identified actionable lessons that organizations can adopt today to enhance cloud security and mitigate breach risks,” said Michael Roza, co-chair, Top Threats Working Group and one of the paper’s lead authors. 

The report notes the prevalence of frequently observed gaps, as well as the growing impact of identity and access management and supply chain risks on cloud security, and the changing profile of threat actors targeting cloud services. Most importantly for cloud users, builders, and defenders, the report shares key takeaways they can implement to further resilience, including: 

• Cloud security must account for human error and persistent threats
• Identity and access security controls are essential
• Shared responsibility in cloud security must be enforced
• Continuous monitoring and real-time detection are critical
• Supply chain security must be strengthened
• Proactive cloud governance reduces long-term risk
• Incident response and recovery must be cloud-specific
• Security testing and validation must extend beyond production

The CSA Top Threats Working Group aims to provide organizations with an up-to-date, expert-informed understanding of cloud security risks, threats, and vulnerabilities in order to make educated risk-management decisions regarding cloud adoption strategies. Individuals interested in becoming involved in the future research and initiatives of this group are invited to join the Working Group.

Read the full Top‌ ‌Threats‌ ‌to‌ ‌Cloud‌ ‌Computing Deep‌ ‌Dive‌ 2025.

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on X @cloudsa.

Media Contacts
Kristina Rundquist
ZAG Communications for CSA
kristina@zagcommunications.com