Download Publication
Who it's for:
- Cloud & IT security professionals
- Compliance & risk professionals
- Executive management
Top Threats to Cloud Computing - Deep Dive 2025
Release Date: 04/28/2025
- Cloud security must account for human error and persistent threats by implementing continuous auditing and security automation
- Strong Identity and Access Management (IAM) practices, including MFA and least privilege access control, must be rigorously enforced
- Cloud providers and users must work together to secure their environments by implementing configuration management and security monitoring
- Anomaly detection and centralized logging are necessary to identify misconfigurations, unauthorized access, and malicious activities quickly
- Continuous monitoring of supply chain security is necessary, since threat actors tend to target supply chain risks
- Proactive cloud governance, such as maintaining secure configuration baselines, reduces long-term risk
- Traditional incident response plans fail to account for cloud complexity, leading to delayed detection and mitigation
- Many breaches originate from vulnerabilities in development and testing environments, where security controls are often weaker than in production
Download this Resource
Prefer to access this resource without
an account?
Download the publication. Download the presentation.
Related Resources
-Platform.jpg)
.jpg)
Acknowledgements
Udith Wickramasuriya
Lakshmi Gudimella
Senior Cybersecurity Manager, Whirlpool Corporation
Shiva Pati
Senior Software Development Engineer
Alex Kaluza
Research Analyst, CSA
Vic Hargrave
Senior Cyber Analyst/Engineer
Vic Hargrave has 20 years of experience in cybersecurity working for Everfox, Forcepoint Federal, Trend Micro, and VMware developing a broad range of security solutions including user-entity behavior analytics, threat management, and content filtering. Vic specializes in behavior analytics and insider threat risk. He has co-authored several publications with the Top Treat Working Group and is active in the CSA AI Technology and Risk Working...
Jon-Michael Brook
Jon-Michael C. Brook is a certified, 25-year practitioner of cybersecurity, cloud, and privacy. He is the principal contributor to certification sites for privacy and cloud security, and has published books on privacy. Jon-Michael received numerous awards and recognition during his time with Raytheon, Northrop Grumman, Symantec, and Starbucks. He holds patents and trade secrets in intrusion detection, GUI design, and semantic data redaction...
Michael Roza
Risk, Audit, Control and Compliance Professional at EVC
Michael Roza is a seasoned risk, audit, control and compliance, and cybersecurity professional with over 20 years of experience across multinational enterprises and startups. As a Cloud Security Alliance (CSA) Research member for over 10 years, he has led and contributed to more than 140 CSA projects spanning Zero Trust, AI, IoT, Top Threats, DecSecOps, Cloud Key Management, Cloud Control Matrix, and many others.
He has co-chaired...
Alexander Getsin
Alexander Stone Getsin is a financial technologies security leader with particular expertise and interest in cloud security, secure application design, and security governance. Alex is the lead author of industry security best practices, particularly with the Cloud Security Alliance, Top Threats research group, and the (ISC)2 Israeli Chapter, which he helps champion as a co-chairman. Alex leverages a decade of experience in finance, militar...
Randall Brooks
Michael Morgenstern
Mark Szalkiewicz
Interested in helping develop research with CSA?
Related Certificates & Training
Learn more