Nearly each organisation working cloud-native techniques has been hit by a safety incident up to now 12 months. The causes are much less dramatic than the frequency suggests, in response to Purple Hat’s 2026 State of Cloud-Native Safety Report, printed on March 24. It states that 97% of organisations reported at the least one cloud-native safety incident over the earlier 12 months.
As per the report’s findings, misconfigured infrastructure or providers had been probably the most generally reported incident kind at 78%, adopted by identified vulnerabilities and unauthorised entry. These should not subtle, hard-to-anticipate assaults however execution failures – recurring and expensive.
The report’s sharpest discovering is the space between how ready organisations consider they’re and what their safety programmes can truly exhibit. In accordance with the 2026 report, 56% of respondents described their day-to-day safety posture as proactive. But solely 39% reported having a mature, well-defined cloud-native safety technique, and round 22% had no outlined technique in any respect. Which means roughly six in ten organisations are working on confidence not construction.
The sensible penalties are evident within the uneven adoption of primary controls. As per the report, identification and entry administration had roughly 75% adoption – one of many strongest figures within the survey. Container picture signing, nonetheless, had been carried out by solely about half of organisations, and runtime safety remained inconsistent, with many groups defaulting to out-of-the-box settings not intentionally outlined insurance policies.
Based mostly on Purple Hat’s knowledge, organisations with a well-defined technique reported 61% confidence in securing their software program provide chain, significantly increased than much less mature friends, and had been much more prone to have deployed superior guardrails of their environments.
Safety slows supply
In accordance with the report, 74% of organisations delayed or slowed software deployments up to now 12 months attributable to safety considerations. Of people who reported downstream results – a determine that reached 92%– 52% stated remediation calls for had consumed extra time than deliberate, 43% reported decrease developer productiveness, and 32% stated incidents had broken buyer belief.
That sample – safety as a brake on supply – is what Purple Hat’s prescription is designed to interrupt. The report argues that embedding safety earlier and extra constantly into growth pipelines reduces the remediation burden downstream, not including friction on the level of deployment.
AI’s governance drawback
The 2026 version of the report introduces a dimension that earlier variations didn’t should deal with at scale: the safety implications of generative AI inside cloud environments. In accordance with the report, 58% of organisations now establish AI adoption as a core driver of their safety planning.
The priority ranges are near-universal; 96% of respondents expressed worries about generative AI in cloud settings, with the principle fears centring on publicity of delicate knowledge, shadow AI instruments deployed with out approval, and the combination of insecure third-party AI providers.
The governance response has not saved tempo. As per the report, 59% of organisations lack documented inner AI use insurance policies or governance frameworks, leaving the bulk managing an increasing and fast-moving set of AI instruments with out agreed-on guidelines for knowledge dealing with, entry, or oversight.
Purple Hat has been working to increase zero-trust rules into the AI agent layer, particularly to handle this. In January 2026, the corporate made its Zero Belief Workload Id Supervisor typically obtainable on OpenShift, offering cryptographically verifiable identities to workloads utilizing the open SPIFFE and SPIRE requirements.
Purple Hat’s personal technical documentation on the discharge reveals the instrument extends the identical identification and entry controls utilized to human-driven processes to AI brokers working at runtime – masking agent-to-agent and agent-to-tool interactions that conventional perimeter safety doesn’t attain.
Anjali Telang, senior principal product supervisor for OpenShift Safety and Id at Purple Hat, described the rationale: “Zero trust means you trust no one, you always verify, and then you base that verification on an identity. With AI, we want to bring in the same trust that we already have built into the system, making sure that trust translates to AI workloads and AI agents.”
In accordance with Purple Hat’s rising applied sciences staff, writing in February 2026, agentic AI techniques introduce what NIST 800-207 defines as a transaction boundary drawback – the place authentication usually occurs solely between the shopper and the agent platform, with no express belief established in subsequent downstream calls. Most safety breaches in recent times have exploited precisely these hidden belief assumptions between elements.
Based mostly on the 2026 report, organisations are altering safety funding away from level instruments and towards platform consolidation and integrating safety immediately into growth workflows. The declared priorities for the subsequent one to 2 years embody DevSecOps automation, cited by over 60% of respondents, to maneuver from handbook assessment gates to safety embedded as code inside CI/CD pipelines. Software program provide chain safety adopted at 56%, and runtime safety growth at 54%.
Regulatory strain is reinforcing these priorities. In accordance with the report, 64% of organisations stated they anticipate the EU Cyber Resilience Act to be a major consider shaping safety funding choices – a determine that implies compliance has moved from a trailing consideration to a boardroom driver.
Purple Hat’s general advice within the report is to ascertain an outlined technique, construct guardrails and automation into platforms not layering them on prime, prioritise provide chain integrity, and introduce AI governance now.
The info makes a transparent case that cloud-native safety’s major drawback in 2026 is the hole between the safety posture organisations consider they’ve and the one their processes and governance constructions maintain.
Purple Hat is exhibiting on the Cyber Safety & Cloud Expo, a part of TechEx North America, on the San Jose McEnery Conference Centre, 18 – 19 Could 2026.
(Picture by Growtika)
See additionally: Cloud demand shifts towards AI as enterprise use deepens
Wish to study extra about Cloud Computing from trade leaders? Try Cyber Safety & Cloud Expo going down in Amsterdam, California, and London. The great occasion is a part of TechEx and is co-located with different main expertise occasions, click on right here for extra data.
CloudTech Information is powered by TechForge Media. Discover different upcoming enterprise expertise occasions and webinars right here.
