Sysdig Cloud Native Security Report 2025

Keypoints

• The report is structured into main sections including key trends, executive summary, threat detection and response, identity management, AI security, container vulnerability management, open source tools like Falco, and methodology details, providing a comprehensive overview of current cloud-native security practices.
• Organizations are now capable of real-time threat detection within five seconds, with incident investigations completed in less than five minutes, emphasizing the critical need for automated response capabilities in cloud environments.
• Key statistics reveal that machine identities are 7.5 times more risky than human identities, with up to 40,000 times more service accounts managed, and container workloads have an average lifespan of five minutes or less, reflecting rapid and ephemeral cloud deployments.
• Threat trends show increasing exploitation of open source software and malware like Mirai, along with evolving attack techniques that bypass signature-based detection, highlighting the importance of layered, behavior-based security approaches.
• Organization-wide management of identities reveals an average of 915 users versus over 41,000 service accounts, with a significant portion of service accounts (60%) maintaining administrator-level privileges without key rotation, indicating areas of potential risk.
• Adoption of AI and generative AI tools in security operations significantly rose, with over 75% of customers using AI packages, and companies reduced public exposure of AI workloads by 38%, demonstrating proactive security enhancements in AI-integrated environments.
• Container security practices now include automated drift control, rapid vulnerability prioritization based on in-use risks, and stark growth in image bloat—quintupling over the year—necessitating regular audits and efficient CI/CD processes.
• Open source security tools like Falco have become widely adopted, reaching over 140 million downloads and achieving CNCF graduation, reflecting maturity and trust in community-driven real-time threat detection for cloud-native environments.
• The report underscores the importance of foundational compliance, nuanced security benchmarks for open source tools, and emphasizes real-time visibility and automated defense to address the rapidly changing cloud-native threat landscape.