Virtually each organisation operating cloud-native techniques has been hit by a safety incident up to now yr. The causes are much less dramatic than the frequency suggests, in response to Purple Hat’s 2026 State of Cloud-Native Safety Report, printed on March 24. It states that 97% of organisations reported a minimum of one cloud-native safety incident over the earlier 12 months.
As per the report’s findings, misconfigured infrastructure or companies have been essentially the most generally reported incident sort at 78%, adopted by identified vulnerabilities and unauthorised entry. These are usually not refined, hard-to-anticipate assaults however execution failures – recurring and dear.
The report’s sharpest discovering is the space between how ready organisations imagine they’re and what their safety programmes can truly exhibit. In response to the 2026 report, 56% of respondents described their day-to-day safety posture as proactive. But solely 39% reported having a mature, well-defined cloud-native safety technique, and round 22% had no outlined technique in any respect. Meaning roughly six in ten organisations are working on confidence not construction.
The sensible penalties are evident within the uneven adoption of fundamental controls. As per the report, id and entry administration had roughly 75% adoption – one of many strongest figures within the survey. Container picture signing, nevertheless, had been applied by solely about half of organisations, and runtime safety remained inconsistent, with many groups defaulting to out-of-the-box settings not intentionally outlined insurance policies.
Based mostly on Purple Hat’s information, organisations with a well-defined technique reported 61% confidence in securing their software program provide chain, significantly greater than much less mature friends, and have been way more prone to have deployed superior guardrails of their environments.
Safety slows supply
In response to the report, 74% of organisations delayed or slowed software deployments up to now 12 months as a result of safety issues. Of those who reported downstream results – a determine that reached 92%– 52% stated remediation calls for had consumed extra time than deliberate, 43% reported decrease developer productiveness, and 32% stated incidents had broken buyer belief.
That sample – safety as a brake on supply – is what Purple Hat’s prescription is designed to interrupt. The report argues that embedding safety earlier and extra persistently into improvement pipelines reduces the remediation burden downstream, not including friction on the level of deployment.
AI’s governance drawback
The 2026 version of the report introduces a dimension that earlier variations didn’t need to deal with at scale: the safety implications of generative AI inside cloud environments. In response to the report, 58% of organisations now determine AI adoption as a core driver of their safety planning.
The priority ranges are near-universal; 96% of respondents expressed worries about generative AI in cloud settings, with the principle fears centring on publicity of delicate information, shadow AI instruments deployed with out approval, and the mixing of insecure third-party AI companies.
The governance response has not saved tempo. As per the report, 59% of organisations lack documented inside AI use insurance policies or governance frameworks, leaving the bulk managing an increasing and fast-moving set of AI instruments with out agreed-on guidelines for information dealing with, entry, or oversight.
Purple Hat has been working to increase zero-trust rules into the AI agent layer, particularly to deal with this. In January 2026, the corporate made its Zero Belief Workload Identification Supervisor usually obtainable on OpenShift, offering cryptographically verifiable identities to workloads utilizing the open SPIFFE and SPIRE requirements.
Purple Hat’s personal technical documentation on the discharge reveals the device extends the identical id and entry controls utilized to human-driven processes to AI brokers working at runtime – overlaying agent-to-agent and agent-to-tool interactions that conventional perimeter safety doesn’t attain.
Anjali Telang, senior principal product supervisor for OpenShift Safety and Identification at Purple Hat, described the rationale: “Zero belief means you belief nobody, you at all times confirm, and you then base that verification on an id. With AI, we need to herald the identical belief that we have already got constructed into the system, ensuring that belief interprets to AI workloads and AI brokers.”
In response to Purple Hat’s rising applied sciences staff, writing in February 2026, agentic AI techniques introduce what NIST 800-207 defines as a transaction boundary drawback – the place authentication usually occurs solely between the shopper and the agent platform, with no specific belief established in subsequent downstream calls. Most safety breaches lately have exploited precisely these hidden belief assumptions between elements.
Based mostly on the 2026 report, organisations are altering safety funding away from level instruments and towards platform consolidation and integrating safety immediately into improvement workflows. The declared priorities for the subsequent one to 2 years embrace DevSecOps automation, cited by over 60% of respondents, to maneuver from handbook assessment gates to safety embedded as code inside CI/CD pipelines. Software program provide chain safety adopted at 56%, and runtime safety growth at 54%.
Regulatory strain is reinforcing these priorities. In response to the report, 64% of organisations stated they anticipate the EU Cyber Resilience Act to be a major consider shaping safety funding choices – a determine that means compliance has moved from a trailing consideration to a boardroom driver.
Purple Hat’s total suggestion within the report is to determine an outlined technique, construct guardrails and automation into platforms not layering them on prime, prioritise provide chain integrity, and introduce AI governance now.
The info makes a transparent case that cloud-native safety’s major drawback in 2026 is the hole between the safety posture organisations imagine they’ve and the one their processes and governance buildings maintain.
Purple Hat is exhibiting on the Cyber Safety & Cloud Expo, a part of TechEx North America, on the San Jose McEnery Conference Centre, 18 – 19 Could 2026.
(Photograph by Growtika)
See additionally: Cloud demand shifts towards AI as enterprise use deepens
Need to be taught extra about Cloud Computing from trade leaders? Take a look at Cyber Safety & Cloud Expo going down in Amsterdam, California, and London. The great occasion is a part of TechEx and is co-located with different main expertise occasions, click on right here for extra data.
CloudTech Information is powered by TechForge Media. Discover different upcoming enterprise expertise occasions and webinars right here.