Survey Shows Cloud Security Programs Still Struggle to Reach Maturity

A recent survey conducted by the SANS Institute reveals that while virtually every organization has moved at least some production workloads to public cloud platforms, the majority have not yet built cloud security programs that meet established maturity criteria.

The research, which gathered responses from a broad cross‑section of enterprises, indicates a gap between cloud adoption rates and the development of robust security controls. Respondents reported using services such as compute, storage, and database offerings in production, yet more than half rated their security posture as “initial” or “developing” rather than “managed” or “optimizing.”

Industry analysts attribute the shortfall to several factors. Rapid migration timelines, a shortage of staff with specialized cloud‑security expertise, and the complexity of configuring native security features are cited as common hurdles. In many cases, organizations rely on legacy security tools that were designed for on‑premises environments, which do not translate seamlessly to the cloud’s shared‑responsibility model.

Security professionals say the findings underscore the importance of adopting a structured maturity framework. Such models typically assess governance, identity and access management, data protection, threat detection, and incident response in the cloud context. By benchmarking against these dimensions, firms can identify gaps, prioritize investments, and track progress over time.

The survey’s results arrive at a moment when regulatory scrutiny of cloud security is intensifying. Data‑protection laws in Europe, the United States, and Asia are beginning to require demonstrable controls for cloud‑based processing. Companies that lag in maturity may face compliance challenges, heightened risk of breaches, and potential financial penalties.

Experts suggest several practical steps for organizations seeking to accelerate their security maturity. First, establishing clear ownership of cloud security—often through a dedicated cloud security team or a cross‑functional governance board—helps align responsibilities. Second, leveraging native security services offered by cloud providers, such as automated configuration checks and identity‑centric controls, can reduce reliance on legacy tools. Finally, investing in continuous training and certification for security staff ensures that expertise keeps pace with evolving cloud services.

Looking ahead, SANS plans to release follow‑up research to track whether organizations close the maturity gap as cloud adoption matures further. The institute’s ongoing monitoring will provide a benchmark for the industry and may inform best‑practice guidelines that help firms translate cloud enthusiasm into resilient security postures.