2024 State of Multicloud
Security Report
Trends and insights to drive an integrated
multicloud security strategy

2024 State of Multicloud Security Report

1

Executive Foreword
The advent of cloud computing ushered in a newera of innovation, empowering organizations torapidly scale and embrace new opportunities.
Today, multicloud environments have become thede facto way of doing business.
However, with all that innovation and flexibility
came new risks. Many customers currently operatewith a complex patchwork of interconnected
technologies across different devices, applications,platforms, and clouds. Since most organizations
connect these data sources so that data canseamlessly flow across boundaries, they need toknow that their protection policies won’t miss any
blind spots between disparate technologies and inturn put their data at risk.
Today, organizations can deploy dozens ofdisparate security tools—each with its own security
alerts to mitigate. Combined with the ongoingcyber workforce shortage and gaps in institutional
knowledge, security teams are overwhelmed andunable to prioritize exposures with the greatest
potential impact. In addition, because each cloud
has a unique security infrastructure, decisioning
logic, and concepts, organizations are left
managing complexity that increases the potential
for mistakes and heightens their risk of a breach.
At Microsoft, we have long embraced ourcommitment to protecting customers’

environments, regardless of how many clouds they
run on or which providers they use.
In February 2022, we became the first cloudprovider to offer integrated cloud-native
application platform protection (CNAPP) fromdevelopment to runtime for Microsoft Azure,
Amazon Web Services (AWS), and Google Cloud
Platform (GCP).1 And we’ve continued to evolve ourmulticloud security offerings ever since throughadvancements like the Secure Future Initiative (SFI),
which aims to transform software development,
implement new identity protections, and drive
faster vulnerability response.2 Today, Microsoft
delivers an unparalleled level of threat intelligence
informed by more than 78 trillion daily security
signals.
It doesn’t stop there. Cybersecurity is an ongoingchallenge. To keep pace with the rapidly changing
tactics of adversaries, we must work together as acollective defense community to share insights,
collaborate on best practices, and better secure ourmulticloud future.
In that vein, we invite you to read and share thefollowing report to more deeply understand thestate of multicloud security risk in 2024, and to
evolve your security strategy to strengthen yourdigital enterprise moving forward.

Andrew Conway
Vice President of Security Marketing, Microsoft“Microsoft Announces New Security Capabilities for the MulticloudWorld,” Microsoft Stories Asia.
1“Announcing Microsoft Secure Future Initiative to advance security
engineering,” Microsoft Security.
2

2024 State of Multicloud Security Report

2

Introduction
Deploying applications and infrastructure
across multiple clouds is the new normal
in today’s business climate. Approximately
86% of organizations have alreadyadopted a multicloud approach thanks to
its benefits including increased agility,
flexibility, and choice.3 However, asorganizations deploy multicloudenvironments, they face many challenges,
including managing security andcompliance across multiple cloud service
providers (CSPs), ensuring data portability,
and optimizing costs.
Informed by usage patterns across
Microsoft Defender for Cloud, Microsoft
Security Exposure Management, Microsoft
Entra Permissions Management, andMicrosoft Purview, we have identified the
top multicloud security risks across
Microsoft Azure, AWS, GCP, and beyond:“SANS 2023 Multicloud Survey: Navigating the Complexities ofMultiple Clouds,” SANS Institute.
3

2024 State of Multicloud Security Report

2

Key findings

1

2

3

Many organizations struggle toproperly secure cloud-native
applications and infrastructure
throughout the full lifecycle.

Securing human and workload
identity access across multiple
clouds is also a significant
challenge due to the rapid
growth in identities and bloatedpermissions.

This increased number ofpotential risks, exploitableattack paths, identities, andpermissions impacts
organizations’ data security
posture.

Microsoft Entra Permissions
Management discovered 209M
identities across its customers’
clouds in 2023.

As multicloud environments
grow in scale, so too does thedata they house and produce.
With more exposed data comes
more risk.

At the development level, 65%of code repositories contained
source code vulnerabilities in
2023, which remained in thecode for 58 days on average.
During runtime, security teams
are often overwhelmed andunable to prioritize the sheer
number of potential risks andexposed assets they must
remediate.
The average organization has
351 exploitable attack paths thatthreat actors can leverage toreach high-value assets. Among
all organizations, over 6.3M
exposed critical assets werediscovered.

Of the 51,000 permissions
granted to those identities (a22% increase from 2022), only
2% were used and 50% wereconsidered high-risk.

Organizations face 59 data
security incidents each year on
average, and 74% oforganizations experienced atleast one data security incident
in which business data was
exposed.

2024 State of Multicloud Security Report3

Secure cloud-native applications
and infrastructure
To ensure the security of your cloudnative applications and infrastructure,
security must be embedded throughout
the full lifecycle. Security teams need aholistic view of the entire development
and deployment process to ensurecomprehensive visibility across sourcecode repositories all the way to cloud
runtime environments.
To understand exactly why a securedevelopment and deployment process is
so critical, we looked at several key data
points for 2023.

2024 State of Multicloud Security Report4

Shift left and embrace DevOps security
Attackers are shifting left, targetingvulnerabilities earlier on in the development
lifecycle. In response, security needs to shift left
too, moving into the very beginning of thedevelopment process as soon as you begin tocreate your code.
When examining multicloud environments, we
discovered that many organizations lack strong
DevSecOps hygiene, exposing them to greaterrisk. There are widespread vulnerabilities living
within source code and code repositories. For
example, nearly one-quarter (23%) of code
repositories contained exposed secrets such as
passwords and API keys in 2023. Adversaries
can use this information to gain unauthorizedaccess to your multicloud environment andtrigger larger attacks that could result in data
breaches, identity theft, and more.
In total, more than 1.4M vulnerabilities werediscovered in connected DevOps repositories,
each posing a serious risk to the security of anorganization’s infrastructure.

Of the code repositories weanalyzed in 2023,

40%

contained supply
chain vulnerabilities

65%

contained sourcecode vulnerabilities

23%

exposed company
secrets, including
passwords and
API keys2024 State of Multicloud Security Report

Identifying and eliminating the number of common
vulnerabilities and exposures (CVEs) in code is alsoessential, considering that CVEs can create serious
issues during development and deployment. We
found that CVEs remained in code for 58 days on
average and could take anywhere from 57 to 64
days to resolve. This leaves a large window of time
for attackers to capitalize on a vulnerability, giventhat 25% of high-risk CVEs are exploited within 24
hours of being published.4

58

5

Preventing these CVEs from being introduced into
the code in the first place is key. A cloud-native
application protection platform (CNAPP) can help
by acting as a shared platform for security admins
and developers alike. This allows security teams tounify, strengthen, and manage multipipeline
DevOps security while shifting security left toenable full-lifecycle protections from a centralized
dashboard.

days CVEs stay in code

CNAPP

57

days to fix high-severity CVEs

58

A unified platform that simplifies
cloud-native application and infrastructure
security by integrating multiple solutions toembed security from initial codedevelopment to provisioning and runtime tohelp mitigate risks across hybrid andmulticloud environments.

days to fix medium-severity CVEs

64

days to fix low-severity CVEsof high-risk vulnerabilities areon the same day they’re
25% exploited
published

DevOps environments can also containmisconfigurations that put an organization’s
infrastructure at risk. For example, we discovered
multiple instances of code repositories that lacked
protection rules on the default branch. This
indicates a broader trend of inadequate security
measures in DevOps environments. Often, essential
safeguards, such as protection rules for code
repositories, are overlooked or not rigorously
enforced. This can expose organizations to risks likeunauthorized access, poisoned pipeline execution
attacks, and code tampering.

4“1 in 4 high-risk CVEs are exploited within 24 hours of going

public,” SC Media.

2024 State of Multicloud Security Report

To address these weaknesses, it's essential to
implement comprehensive security protocols
across all stages of the development lifecycle.

47%of service connections in
Azure DevOps gave
access to all pipelines

73%

of GitHub repositories
lacked protection rules on
the default branch

52%

of GitHub repositories
that connected to Azure
lacked protection rules on
the default branch

These misconfigurations must be addressed if
organizations are to lower their risk of sensitive
data exposure, system compromise, user harm,and more.

6

Focus on a
preventative,risk-based approachwith attack pathanalysis
Another key tool for proactively securing cloudnative applications and infrastructure is attack pathanalysis, often delivered through a cloud security
posture management (CSPM) solution.
Understanding attack path analysis allows
organizations to identify and remediate critical risks
in their environment—such as misconfigurations,
vulnerabilities, permissions, and sensitive data—
before attackers can exploit them. Think of theserisks as a string of vulnerabilities andmisconfigurations that might seem innocuous whenviewed in isolation. However, when they aresurfaced by a CSPM tool and consolidated into an
attack path, organizations can view the full impactof each risk and remediate them proactively.
Take the example of source code vulnerabilities.
Attack path analysis can flag a vulnerability andshow how attackers could use it to breach yourenvironment and move laterally to reach criticalassets. Even more crucially, attack path analysis canprioritize which attack path security teams should
address first based on the potential impact to yourenvironment and suggest remediation next steps.

2024 State of Multicloud Security Report

7

Attack path:
Exploitable paths that attackers might use to breachyour environment and access high-impact assets

88% of Microsoft Security Exposure Management
public preview customers had an attack path that
led to a critical asset

Attack path analysis:

5.4M

A pre-breach analysis performed by correlating
security risk in and across environments to provide
visibility into how an attacker could infiltrate andmove through your multicloud estateincluded critical
identities

Without attack path analysis to illuminate these
exploitable paths, many organizations may noteven be aware that their critical assets are at risk.
Among Microsoft Security Exposure Management
public preview customers, 88% had an attack paththat led to a critical asset and more than 6.3M
exposed critical assets were discovered, including
identities, devices, and cloud resources.
Microsoft Security Exposure Management is anattack surface management tool designed to helporganizations identify, prioritize, and remediate
critical exposures by collecting and normalizing
asset data, mapping assets and their relationships,
and providing comprehensive visibility into theattack surface.

6.3M
critical assets
discovered

228K

682K

included critical
cloud resources

included criticaldevices

2024 State of Multicloud Security Report

Unaddressed attack paths can also lead tosignificant damage across multicloud environments,
including compute abuse, data exposure, and user
credential exposure. These attack paths arewidespread, in some cases occurring acrossmultiple cloud environments.

49%

24%

of attack paths could result incompute abuse, such as theunauthorized use of cloudcomputing resources

Attack paths are by no means uncommon. Morethan half of organizations were exposed to at least
one attack path in 2023, with the averageorganization containing 351 attack paths acrosstheir multicloud environment. These attack paths
can occur for a variety of reasons, with the mostcommon causes being internet exposure andinsecure credentials.

58%

of organizations are exposed to atleast one attack path7%of organizations are exposed to morethan 1,000 attack paths351

attack paths at the averageorganization

84%

of attack paths originate because
of internet exposure

66%

of attack paths involve insecure
credentials

of attack paths could result indata exposure to the internet or
unauthorized users

20%

of attack paths could result incredential exposure such as
improperly secured passwords
or keys7%of attack paths could result insensitive data exposure likepersonal information orcompany secrets

1%

8of attack paths werecross-environment, such as
across clouds or from codedevelopment to cloud runtime
environments

By taking a shift-left approach to security,organizations can proactively identify andremediate these attack paths before threat actors
have a chance to exploit them.

2024 State of Multicloud Security Report9

Did you know that just a fraction of the resources
used in multicloud environments are responsible
for a larger percentage of attack paths?

Attack path block point
Internet
exposure

VM with RCE CVE

Publicinternet

IAM

Identity

SecretStorage

Data security

IAM

Identity

Key vault

Sensitive
data (ex.??)VM

Block point

Subscription Resource group

Storage

SQL
Attack path
SQL

Secure across (IAM)
Data security

AKS

Context

This is because of the proliferation of block
points, or areas in the cloud network where mostof the network traffic flows through. If
compromised, these points allow attackers tobranch out and access more resources withinyour network.
The diagram above shows multiple attack paths
originating from the public internet. In thisexample, there are three virtual machines (VMs)with a remote code execution (RCE) CVE.
Adversaries can take advantage of these CVEs togain access to an identity, establish a foothold inyour environment, and move laterally to accesssensitive data, a key vault, or an AKS cluster.
Threat actors can target all of these potential
attack paths, even opting to pursue one attack
path at a time so that, if detected in one path,they can pivot their strategy and maintain afoothold in the environment.
Organizations can secure these block points byimplementing CNAPP to prevent adversaries
from progressing along the attack path.

2024 State of Multicloud Security Report

Reduce complexity
with threat protection
In addition to DevOps security and attack pathanalysis, organizations also need to consider how
the growing use and variety of cloud workloads
impact their exposure to cyberthreats.
When cloud workloads span across multiple cloudenvironments, that creates a larger, more complex
attack surface for security teams to contend with.
These intertwined workloads create additional
complexities and dependencies that require proper
configuration and monitoring to secure. Manycompanies also rely on individual point vendors tomanage a piece of their workload protection.
However, this approach misses the bigger picture
and overlooks the potential cross-workload risks inmulticloud environments.
For example, consider a company that uses two
different cloud security solutions for API and data
storage protection. Suppose a compromised API
links to data storage, but the two point solutions
can’t communicate or integrate. The complexity
between these different types of workloadinteractions can increase your attack surface. This is
why comprehensive threat protection is such a
critical focus in multicloud security.

102024 State of Multicloud Security Report

There are three main challenges with multicloudthreat protection.
The first is the growing sophistication of attack
tactics and the use of AI by threat actors. As cloud
adoption grows, traditional threat surfaces are
expanding and network perimeters havedisappeared. This introduces novel attack scenarios
and techniques. For example, threat actors like
Charcoal Typhoon have been known to use large
language models (LLMs) to support toolingdevelopment and scripting, understand various
commodity cybersecurity tools, and generatecontent that could be used to social engineer
targets.5
Charcoal Typhoon is a Chinese state-affiliatedthreat actor with a broad operational scope. They
are known for targeting government, higher
education, communications infrastructure, oil andgas, and information technology sectors.
Secondly, organizations may have resources acrossdifferent cloud providers, each of which canconnect to different identity providers. This expands
the organization’s overall attack surface. Consider
the example of a cross-cloud supply chain attack. In
this scenario, developers build pipelines in Azure
DevOps (ADO). They then build Docker containers
and put them in a registry, with images being
picked up from anywhere. Kubernetes workloads
may be deployed in a certain cloud provider, suchas Azure Kubernetes Service (AKS), while also using
images stored in a different cloud provider, like
AWS’s Elastic Container Registry (ECR). Because
these images are stored in ECR but deployed in
AKS, attackers could potentially target them to
execute a cross-cloud supply chain attack.
In total, roughly 10% of Azure clusters use cloudservices from a different cloud provider. For
example, a workload running on AKS might use
AWS’s S3 storage to store data.

5“Staying ahead of threat actors in the age of AI,” Microsoft

Threat Intelligence.

11

Finally, because modern IT environments spread
across multiple platforms, many organizations lackstrong visibility into what is going on across all theirdifferent clouds. They need a better way tocentralize and contextualize findings across theirvarious security approaches.
For example, Microsoft’s CNAPP solution, Defenderfor Cloud, has an extended detection and response(XDR) integration that provides richer context toinvestigations and allows security teams to get thecomplete picture of an attack across cloud-native
resources, devices, and identities. Roughly 6.5% of
Defender for Cloud alerts were connected to otherdomains—such as endpoints, identities, networks,
and apps and services—indicating attacks thatstretched across multiple cloud products andplatforms.

6.5%

of organizations withDefender for Cloud alerts in
XDR were connected toother domains, indicating
attacks that stretched acrossmultiple cloud products andplatforms

This number will only increase as additionalcorrelation logic is added, which can help identify
and link related security events to detect potential
threats.

2024 State of Multicloud Security Report

12

Recommendations
Ultimately, protecting cloud-native applications
and infrastructure starts with adopting a shift-leftapproach to security. This ensures that thedevelopment and deployment process is securefrom the very start. A CNAPP solution can help
enforce security best practices in the earliest
stages of development and promote a holistic
software development lifecycle (SDLC) for all
cloud-native applications. However, for this towork, you must ensure that your application
security is developer-friendly.
At Microsoft, we offer native security tooling with
GitHub Advanced Security for both GitHub and
Azure DevOps. This allows developers to workwithin their native tools while still enforcing
security best practices across the code andapplication development lifecycle. By eliminatingor fixing security alerts earlier in the development
process, the development cycle can move much
faster and be less costly.
Additionally, security teams should leverage
attack path analysis within a CSPM as the firstline of defense when managing cloud security
posture as part of an organization-wide proactive
attack surface and risk management continuous
threat and exposure management program.6 For
both attack paths and threat protection, it’s
important to maintain Zero Trust best practices
by assuming breach and limiting exposure byadding multiple layers of protection across theenvironment.

For example, we found that internet-exposed VMs
have a 6.5 times greater chance of compromise
compared to non-exposed machines. Furthermore,
15% of internet-exposed machines are targeted bybrute force attacks. This indicates that attackers areattempting to gain access to someone’s identity
through password spraying, which, if successful,
would provide initial access to their cloudcomputing resources. That is why avoiding exposing
management ports to the internet is essential.
Instead, use a closed management interface to gain
connection without exposing potentially sensitive
resources to the internet.

Leverage a holistic CNAPP solution to
integrate security checks and controls into
the DevOps pipeline and implement
comprehensive
cloud-native workload monitoring andprotection
Focus on a preventative, risk-based approachby leveraging attack path analysis toproactively identify and remediate potential
attack paths before they can be exploited.
CSPM enables you to reduce attack surface
and manage risk in your multicloudenvironment, and Exposure Management
extends your proactive program across yourwhole organization
Follow Zero Trust best practices by assuming
breach and limiting internet exposure unlessabsolutely necessary, especially in the case ofmanagement ports. Instead, use a closed
management interface to establish aconnection without risky internet exposure

6“How to Manage Cybersecurity Threats, Not Episodes.” Gartner.

2024 State of Multicloud Security Report

13

Secure human and workload
access across multicloud
Another foundational element ofmulticloud security is identity and accessmanagement. Not only do security
teams have to monitor and secure user
identities, but they also must accountfor workload identities. This is especiallychallenging given how quickly identities

and their access to cloud resources havegrown in recent years, with more andmore workload identities gaining
increased access to cloud resources.
Workload identities currently outnumber
human identities, and that gap is only
growing.

2024 State of Multicloud Security Report

14

Protecting workload
identities is of criticalimportance
As more and more companies move their workloads
to the cloud, we're seeing a rapid growth in thenumber of workload identities being created. Today,
there is one human identity for every 10 workload
identities. This problem is even more acute amongsmall- and medium-sized businesses, which have
one human identity for every 50 workload identities.
Of the 209M identities Microsoft Entra Permissions
Management discovered across its customers’
clouds in 2023:

34.5M

174.3Mare human
identities

are workload
identities

209M

have a clearly defined lifecycle. When a new
employee or a third-party contractor joins yourcompany, they have a clearly defined start datethat’s often accompanied by HR and other related
processes. When their engagement with yourorganization ends—whether because they moved
on to a new job or their contract ended—that final
date is also clearly noted across multiple company
systems.
However, the same is not true of workload identities,
which can gradually taper out and become inactive.
This is especially true when you consider thewidespread use of shadow IT across multicloudenvironments. Inactive identities are not monitored
the same way as active identities, making them anattractive target for adversaries to compromise as
they can leverage the identity or credentials tomove laterally throughout your environment.
Workload identities can also be manually embedded
in code, making it harder to clean them without
triggering unintended consequences.

Workload identities:
Identities assigned to software workloads, suchas apps, microservices, and containers.

Identities

Inactive identity:
As the number of workload identities continues to far
outpace the number of human identities, it’s important
to consider the relative risk of each. Fewer solutions
can adequately protect workload identities comparedto how these solutions can protect and secure humanidentities. This is because the majority of identity andaccess solutions in the market today have primarily
focused on safeguarding human identities rather thanworkload identities.
Workload identities are also much more difficult tosecure than human identities because they don’t

An identity that hasn’t logged in or used any of
its permissions in the last 90 days

Permissions:
The ability for an identity to perform an action
on a resource

High-risk permissions:
Permissions that can cause data leakage,
service disruption, or service degradation if
misused or exploited2024 State of Multicloud Security Report

One bright note is that the number of inactive
workload identities has dropped year over year
according to data from Microsoft Entra Permissions
Management.

Of the 174.3M workload identities identified
Inactive workload identities
100%

80%
50%

40%
0

2022

2023

In 2022, 80% of workload identities were considered
inactive whereas just 40% of workload identities
were inactive in 2023. This shows us that
Permissions Management helped organizations
better manage inactive workload identities throughincreased visibility. Organizations are also beginning
to realize the importance of securing workload
identities. Once companies understand how crucial
workload identities are to their overall risk posture, it
becomes possible to secure them better.

15

Managing super
identities is a crucial
task for securing
accessFurther complicating identity security is the fact thatthe majority of identities are vastly overpermissioned. When an identity can access any
permission or resource across your entire multicloudestate, it is known as a super identity.
A term originally coined by Microsoft in the 2023
State of Cloud Permissions Risks report,
compromised super identities can allow attackers togain access to all permissions and resources—
putting them in a very powerful.7

Super identity:
A user or workload identity that has access toall permissions and all resources across yourentire cloud estate.

Since last year, the percentage of super identities
has remained the same, accounting for more than
50% of all identities. Ideally, this percentage would
decrease so there is less opportunity for attackers togain access to a wide breadth of permissions andresources—thus minimizing the blast radius fromany potential breaches.
This problem is even more pronounced among
workload super identities, which increased in 2023.
In 2022, there were four human super identities forevery six workload super identities. In 2023, thatratio increased to three human super identities forevery seven workload super identities. Given theinactivity of workload identities in 2023, a significant
number of workload super identities are likely not
being managed—leaving them vulnerable to an
attack.

“2023 State of Cloud Permissions Risks report now published.”
Alex Simons.
72024 State of Multicloud Security Report

Of the 209M cloud identities identified in 2023,

50%+

16

Unused permissions
represent asignificant risk

were super identities
The problem of unused permissions stretches
across human and workload identities in the cloud.

There were 3 human super identities for every
7 workload super identities:
If we are to properly secure identity and access as acollective defense community, we must focus on
managing and lowering the number of super
identities. The first step is establishing visibility into
all super identities across your multicloud estate.
From there, security teams can begin obtaining
insights into unused permissions and right-sizing
permissions in accordance with least privileged
access principles.

Microsoft Entra Permissions Management
discovered more than 51,000 permissions granted
to human and workload identities in 2023 (up from40,000 in 2022). With more permissions come moreaccess points for attackers. As evidenced by thecontinued prevalence of super identities, many ofthese permissions aren’t even being leveraged fully.

2%of human and workload identity
permissions were used in 2023

3%

of workload identity permissions wereused in 2023

Our data shows that just 2% of the permissions
granted to human and workload identities in 2023
were used, and only 3% of workload identity
permissions were used. While a slightly higher
percentage of workload identity permissions arebeing used compared to human identity
permissions, the remaining 97% of unused
permissions still represent a valuable and attractive
target for attackers. Too many identities continue tobe far over-provisioned, increasing the number ofidentities that pose a potential security risk.

2024 State of Multicloud Security Report

17

Recommendations
In the realm of identity and access management,
the handling of identities (both human andworkload) and their access remains a formidable
challenge. This is primarily due to the nature of
their permissions, which are akin to root access.
Managing these identities within a multicloudenvironment continues to be a significant hurdle.
Our observations indicate that customers are
adopting various strategies to tackle this issue.
Some focus on identity governance, while others
establish automated access through Infrastructure
as Code (IaC) services. Yet others rely on native
cloud service providers to govern resource accessauthorization.
It’s important to note that an Azure subscription,
AWS account, or GCP project with multiple super
identities signifies an elevated level of insider risk
exposure. A cloud infrastructure entitlement
management (CIEM) solution can provide visibility
that eliminates the need for standing access forsuper identities, inactive identities, and unused
permissions. Once the CIEM has identified
entitlements, organizations can then take steps torevoke unnecessary permissions and ensure theseidentities are allocated just-enough permissions,just in time. This approach will significantly mitigate
potential risks and enhance the overall security
posture.
At Microsoft, we leverage our CIEM solution,
Microsoft Entra Permissions Management, toestablish visibility into who and what has access towhich resources so we can ensure those accessrights align with least privilege principles. Identities
and their permissions are often the first entry point
for attackers, so enforcing Zero Trust principles ofleast privilege access and explicit verification is
crucial for hardening the overall security posture ofcloud environments.
Permissions Management also provides
remediation and monitoring capabilities, along witha permissions creep index (PCI) to measure how
well an organization protects its permissions risks
across multiple clouds. Among customers who haveused Permissions Management since 2022, we’veseen a 21-point improvement in their overall PCI
score. Furthermore, by integrating Permissions
Management, with other security postures throughDefender for Cloud, organizations can better
understand how unnecessary permissions create avulnerability vector as well as its relative importanceto the overall security of the environment.

Define your vulnerable attack surface bygaining clear visibility into any identities,
including high-risk permissions, inactive
identities, and super identities
Remove any unnecessary permissions fromidentities and replace with just-in-time
permissions that the identity must inherit
before it can perform a task
Manage super identities by adhering to Zero
Trust principles of least-privileged access andexplicit verification

2024 State of Multicloud Security Report

18

Safeguard growing data
In the expanding multicloud universe,
data is being generated at an
unprecedented rate. The rapid adoptionof generative AI technology is only
accelerating this trend. As per IDC,
between 2023 and 2027, the amount ofdata created, captured, and replicatedacross the globe is expected to morethan double in size, with an estimated
129 zettabytes generated in 2023.8

We’ve also seen a growth in data
sources, making it challenging fororganizations to secure sensitive data
across their estate. To safeguard theirmost critical asset—their data—
organizations must take acomprehensive approach to data
security. An approach that helps them:
Discover risks to their sensitive
data, including employee andcustomer data, intellectual
property, financial projections,and operational data across theirmulticloud universe
Understand how users interact
with data
Protect and prevent
unauthorized use of that data
throughout its lifecycle withprotection controls likeencryption and authentication

8“Worldwide IDC Global DataSphere Forecast, 2023-2027.” IDC.

2024 State of Multicloud Security Report

19

Data security incidents have become bothcostly and frequent
From October 2022 to October 2023, a whopping
74% of organizations experienced at least one data
security incident in which their business data was
exposed.9 Data security incidents pose anenormous risk to organizations. Not only canorganizations lose business-critical data andcustomer trust, but these incidents can also be very
costly in terms of prolonged downtime,59

On average, organizations face 59 data security
incidents every year. Depending on the severity of
the incident, organizations could be facing millions
in potential damages.

is the average number of data security
incidents per year organizations face74%

of organizations experienced at least
one data security incident in whichbusiness data was exposed

$15M

9

reputational damages, lost business partnerships,
and legal ramifications.

“Data Security Index.” Microsoft.

10“Data Security Index.” Microsoft.

is the average cost of data security
incidents10

2024 State of Multicloud Security Report

A fragmented
solution landscape
can increase thenumber of data
security incidents
When tasked with managing data security across
a complex multicloud environment, manyorganizations will opt to deploy and manage
several distinct, un-integrated solutions to cover
all the various use cases. However, our researchfound that a fragmented solution landscape
weakened data security. For each tool anorganization adopts, they must then dedicate
staff and processes to maintaining and operatingthat tool. This is because each vendor provides a
distinct portal with varying technologicalfoundations.

2.8x

as many data security incidents areexperienced by organizations with
16+ point solutions when compared
to organizations with fewer tools

The proliferation of tools also leads to anincrease in the number of alerts. At times, thesealerts may be duplicated, creating more noise in
the system. Organizations employing more than
16 tools to secure data face a staggering 2.8
times more data security incidents compared tothose who use fewer tools. Moreover, the severityof these incidents tends to be higher as well.

19

2024 State of Multicloud Security Report

Given the complexities of using disparate solutions,organizations should seek to reduce and refine thenumber of solutions they deploy to manage data
security. We recommend leveraging an integrated
set of solutions that work seamlessly and alleviate
the complexities discussed above.
It is also important to understand the main sourcesof these data security incidents. Malware andransomware are common causes, underscoring theneed for a comprehensive data security solution to
mitigate and prevent these kinds of attacks.
Additionally, we are seeing a significant portion ofdata security incidents occur in the email,messaging, and collaboration apps that employees
use every day to stay productive and work together.
Enforcing extremely strict protection policies on all
your users can disrupt the flow of data in an
organization, which is crucial to getting work done.
On the other hand, lack of protection posessignificant risk to the data as discussed above.
Instead, organizations need a data security solutionthat is flexible enough so that they do not have tochoose between protection and productivity andinstead can achieve a sweet spot that works forthem. An important part of achieving this balance isto apply restrictive policies only to high-risk users sothat other users in the organization can maintaintheir productivity.

20

50%

of data security
incidents happen due
to ransomware or
malware42%of data security
incidents happen in
the cloud31%

of data security
incidents happen
across email,messaging, andcollaboration apps

2024 State of Multicloud Security Report

A modern approachto data security is aproactive one
In addition to having too many tools, manyorganizations are in a reactive state of data security
rather than a proactive one. In a reactive approach,organizations tend to play catch-up after theincident has occurred. A proactive approach is one
in which organizations can prevent the data security
incident from happening in the first place. For aproactive approach, organizations need to build
multiple layers of protection for the data—one thatcombines the context of the data with the context
of the user interacting with the data to provide
comprehensive insights.
This multilayered approach becomes even more
relevant when you consider the fact that
misconfigured APIs were one of the leading causesof cloud data breaches in 2023. A multilayered
approach to data security can help security teams
proactively detect and monitor misconfigurations,so they can remediate as needed.

90%

21

The components of a multilayered data security
strategy are:Create policies that prevent the unauthorized
or unintentional use of data, including
copying or printing sensitive information,
sharing sensitive data through regularcommunications channels, or even uploading
the sensitive data to personal cloud storage
Understand how your users are interactingwith the data to identify anomalies andprevent users from maliciously or negligently
causing loss to the data
Classify and label sensitive data. Dependingon the level of security necessary, allbusiness-critical data should be classified
and then subsequently labeled to support
appropriate protection such as encryption
Leverage automation to ensure that policies
can be automated adjusted based on theuser’s risk level and your security team does
not have to manually add and remove users
in and out of policy scopeof data breaches in the cloud happen
due to misconfigured APIs40%of data loss incidents
happen due tomisclassified or
mislabeled assets

Roughly 40% of organizations experience data loss
because of misclassification or incorrectly labeledassets. To resolve this challenge, organizations
need a robust data security solution that provides
data loss prevention technology.

2024 State of Multicloud Security Report

Recommendations
To comprehensively secure data, organizations needan integrated solution that can combine data
context with user context across their multicloudestate. Without this multilayered approach,organizations will continue to be reactive inpreventing unauthorized access to their sensitive
data from external threats or mitigating the risk ofinsider data theft or accidental exposure.
Microsoft Purview—a comprehensive data security,
data compliance, and data governance solution canhelp safeguard your data across your multicloudestate. Microsoft Purview can help discover hidden
risks to your data wherever it lives or travels, protect
and prevent data loss across your data estate, andquickly investigate and respond to data security
incidents. It can also be used to help improve risk
and compliance postures and meet regulatory
requirements.

Adopt a multilayered approach todata security
Make data security a proactive
conversation rather than reacting toan incident
Focus on fewer tools and leverage an
integrated solution to limit blind
spots and reduce your risk of data
security incidents

222024 State of Multicloud Security Report

Executive conclusion
In closing, multicloud security can often be acomplex endeavor, with multiple considerations
and potential risks that security teams must accountfor. It starts in the earliest stages of cloud-native
application and infrastructure development andextends throughout identity and accessmanagement, as well as data security.
Adopting a shift-left approach to security with aunified CNAPP solution can help integrate security
checks and controls earlier on in the DevOps
pipeline while also ensuring comprehensive cloudnative workload monitoring and protection.
Meanwhile, attack path analysis enables
organizations to achieve a more proactive state of
security, especially when leveraged as the first lineof defense for managing cloud security posture.
When it comes to application and infrastructure
threat protection, a Zero Trust mindset of assuming
breach and limiting internet exposure can reducean organization’s overall risk posture.
In the critical area of identity, organizations mustenhance protections for workload identities andmanage the occurrence of super identities byadhering to Zero Trust principles around leastprivileged access and explicit verification. A CIEM
solution can also help limit the number of individual
point solutions an organization needs to deploy.
Finally, organizations must fortify their data security
by adopting a multilayered approach. This enables
organizations to be more proactive in their data
security, while also safeguarding data andmanaging data compliance throughout the fulllifecycle of the data.

23

2024 State of Multicloud Security Report

To learn how you can improve security withcode-to-runtime insights across multiple cloudenvironments and DevOps platforms, visit
Microsoft Cloud Security.
Learn more about Defender for CloudTo learn more about your multicloud identity andaccess vulnerabilities, sign up for a free trial of
Microsoft Entra Permissions Management andreceive your customized risk assessment report.
Try Permissions Management

To gain deeper visibility into your multicloud data
estate and understand what a comprehensive
approach to data security could do for you, sign
up for a free trial of Microsoft Purview.
Try Purview

© Copyright Microsoft Corporation. All rights reserved.