Orca State of Cloud Security Report 2025

Keypoints

• The typical structure of annual cybersecurity reports from major vendors includes sections such as an executive summary, key findings, detailed analysis of cloud usage, specific threat areas like AI security and vulnerabilities, attack path analysis, data exposure risks, and strategic recommendations.
• Key statistics reveal that 115 vulnerabilities are present on average per cloud asset, with 58% of organizations confronting vulnerabilities older than 20 years, indicating persistent patch management issues.
• Notable trends include the rise of multi-cloud adoption (55% of organizations), increased AI-related CVEs (62% with vulnerable AI packages), and widespread neglect of assets (32% in a neglected state), which heighten security risks.
• Main threats involve extensive attack paths (over 1,000 in some assets), exposed sensitive data (38% of organizations), and the exploitation of outdated vulnerabilities like Log4Shell and Spring4Shell, exacerbating breach risks.
• Significant findings emphasize that attackers can exploit interconnected risks across cloud environments, with 76% of organizations hosting assets enabling lateral movement, underscoring the importance of prioritized detection and mitigation strategies.
• Recurring themes include the critical need for vulnerability management, reducing neglected assets, securing AI and Kubernetes workloads, and protecting sensitive data amid increasing cloud complexity.