The average data breach now costs US organizations $10.22 million — an all-time high, and more than double the global average of $4.44 million. Those numbers come from IBM’s Cost of a Data Breach Report, which surveyed 600 organizations across 17 industries. They reflect what actually happens when cloud security fails: forensic investigations, regulatory fines, legal fees, lost customers, and operational downtime that hits revenue the moment systems go offline.
Cloud storage is not inherently less secure than on-premises infrastructure. In many ways it is more secure — major cloud providers invest more in physical security, network monitoring, and vulnerability patching than most individual organizations can afford. The problem is not the provider’s infrastructure. The problem is how organizations configure, manage, and govern their cloud environments once they are in use. Misconfigurations, stolen credentials, and ungoverned AI adoption are responsible for the majority of cloud breaches in 2026 — and all three are within the organization’s control to fix.
This article covers what data security in cloud computing actually means, where breaches come from in practice, what the shared responsibility model requires from your organization, and which security controls deliver the most measurable reduction in breach cost and likelihood.
What the Numbers Actually Show
The headline breach cost figures deserve context before drawing conclusions from them. IBM’s global average of $4.44 million fell 9 percent in 2025 — the first decline in five years — driven by faster AI-powered detection at security-mature organizations. But that global decline is misleading in isolation for US-based businesses. The US average hit $10.22 million, a 9 percent increase year-over-year, driven by steeper regulatory fines, higher litigation exposure from 50 different state-level breach notification laws, and higher concentrations of healthcare and financial services companies that face the costliest breaches of any industry.
Cloud environments specifically carry a cost premium over on-premises breaches. Breaches involving public cloud environments cost $5.17 million on average — the highest of any storage environment. Breaches spanning multiple environments — public cloud, private cloud, and on-premises simultaneously — averaged $5.05 million, compared to $4.01 million for purely on-premises incidents. The complexity of hybrid and multi-cloud architectures is a direct cost driver, because data flows between environments in ways that are harder to monitor and harder to contain when something goes wrong.
Detection speed matters more than most organizations realize. IBM’s data shows a clear cost threshold at 200 days. Breaches contained in under 200 days cost $3.87 million on average. Breaches taking longer than 200 days cost $5.01 million — a $1.14 million penalty for every additional month of dwell time. The average breach lifecycle was 241 days in 2025 — 181 days to detect, 60 days to contain. That is more than six months of a threat actor inside your environment before containment, on average.
The single most actionable finding from IBM’s data: organizations using AI and automation in their security operations saved $1.9 million per breach on average and detected incidents 80 days faster than organizations without those tools. This is not a marginal improvement — it is the largest single-variable cost reducer in the entire dataset.
The Shared Responsibility Model: What Your Organization Actually Owns
The shared responsibility model is the foundational concept of cloud security, and it is also the most commonly misunderstood one. The model divides security duties between the cloud provider and the customer — but the split is not 50/50, and understanding exactly where it falls determines what your organization needs to manage.
Cloud providers — AWS, Azure, Google Cloud, and others — are responsible for securing the physical infrastructure: the data centers, the networking hardware, the hypervisor, and the underlying compute infrastructure. They patch the hardware, manage physical access controls, operate the global networking infrastructure, and maintain the availability of the platform itself. This is what Amazon calls “security of the cloud.”
Your organization is responsible for everything that sits above that infrastructure layer: the data you store, the applications you run, how you configure cloud services, who has access to what, and how identities and permissions are managed. This is “security in the cloud” — and it is where the overwhelming majority of cloud breaches originate.
The practical implications are significant. If you misconfigure an S3 bucket in AWS and expose sensitive data to the internet, that is not AWS’s responsibility to prevent — it is yours. If an employee’s credentials are stolen through phishing and an attacker uses them to access your cloud resources, AWS did not fail — your access management did. If you store unencrypted customer data in a cloud database and a vulnerability in your application exposes it, the cloud provider’s infrastructure security is irrelevant to that breach.
This is why “we moved to the cloud” does not mean “we solved our security problems.” It means you changed which security problems are yours to solve.
Where Cloud Data Breaches Actually Come From
Misconfiguration — The Leading Cause
Misconfiguration is consistently the leading cause of cloud data exposure. The most common examples are storage buckets — S3 in AWS, Blob Storage in Azure, Cloud Storage in GCP — left publicly accessible when they should be private. But misconfiguration extends to every cloud service: poorly scoped Identity and Access Management (IAM) policies that grant more permissions than necessary, security groups that leave ports open to the internet, encryption disabled on databases, logging turned off, and API keys embedded directly in application code.
In 2026, a cyberattack targeting Cloud Imperium Games exposed user information — names, contact details, and account data — after attackers gained access through a misconfigured system. This type of breach is not a sophisticated attack. It is an organizational failure that a basic cloud security posture review would have caught.
Cloud Security Posture Management (CSPM) tools automate the detection of misconfigurations across cloud environments, running continuous checks against security benchmarks and alerting on deviations. For organizations managing multiple cloud accounts or services, manual configuration audits cannot keep pace with the rate of change — CSPM is the practical solution at scale.
Stolen Credentials — The Costliest Attack Vector
Stolen credentials are the most expensive breach vector IBM tracks — breaches caused by stolen credentials took an average of 292 days to resolve in IBM’s dataset, the longest detection-to-containment cycle of any attack type. The reason is structural: a valid username and password grants legitimate-looking access. The attacker is not “hacking in” — they are logging in. This bypasses perimeter defenses, generates no malware alerts, and triggers no anomaly detection based on the access pattern alone.
The credential theft pipeline in 2026 typically starts with phishing — 60 percent of breaches involve the human element, including phishing, social engineering, and insider negligence. Once credentials are stolen, attackers test them across cloud services, escalate privileges where possible using misconfigured IAM policies, and move laterally through the environment before eventually exfiltrating data or deploying ransomware.
Phishing-resistant multi-factor authentication — FIDO2 passkeys and hardware security keys rather than SMS codes, which are themselves phishable — is the single highest-impact credential security control available. SMS-based MFA is meaningfully better than no MFA, but it is not phishing-resistant. Organizations handling sensitive data should be moving toward FIDO2-based authentication for all privileged access.
Ransomware — Now Targeting Cloud Environments Directly
Ransomware was present in 44 percent of breaches in 2025, up from 32 percent the prior year. The attack pattern has evolved significantly from the early era of ransomware that simply encrypted local files. Modern ransomware targeting cloud environments exfiltrates data before encrypting it — meaning paying the ransom does not prevent the data from being leaked or sold. When attackers exfiltrated data alongside encryption, the average extortion cost was $5.08 million. Government agencies face a particular variant of this problem: 98 percent of successful ransomware attacks against government targets resulted in data encryption, the highest encryption rate of any sector.
Cloud-specific ransomware protection requires immutable backups stored in isolated environments that cannot be reached from the primary cloud infrastructure. Backup targets that share network access with production systems — or that use the same credentials — can be encrypted alongside the primary data, eliminating the recovery option entirely. Isolated recovery environments are the control that makes ransomware a recoverable incident rather than a catastrophic one.
Insider Threats — Underreported and Expensive
Insider threats encompass both malicious insiders — employees or contractors who deliberately misuse their access — and negligent insiders who cause breaches through poor security hygiene without malicious intent. Both categories are materially underreported in breach statistics because organizations are reluctant to publicly attribute incidents to internal actors.
The structural driver of insider risk in cloud environments is overly permissive access. When IAM policies grant users more permissions than their job function requires, a compromised insider account or a negligent action by a legitimate user can reach data it should never have accessed. The principle of least privilege — granting each account only the permissions necessary for its specific function — directly limits the blast radius of both malicious and negligent insider incidents.
Shadow AI — The Newest Exposure Category
Shadow AI is the 2026-specific addition to cloud security threat lists. IBM’s Cost of a Data Breach Report found that 20 percent of breached organizations experienced incidents linked to shadow AI — unsanctioned AI tools adopted by employees without IT or security oversight. These incidents added an average of $670,000 to breach costs above the baseline, and 65 percent of shadow AI breaches exposed customer personally identifiable information.
The mechanism is straightforward: employees use unauthorized AI tools to improve productivity, paste sensitive data into prompts, and that data is processed by third-party systems outside the organization’s security perimeter and data governance policies. IBM found that 63 percent of breached organizations lacked AI governance policies, and only 37 percent had approval processes for AI tool adoption. As AI tool usage continues to expand in 2026, the absence of AI governance is shifting from a compliance gap to a direct breach risk.
Key Data Security Controls for Cloud Environments
Encryption: At Rest and In Transit
Encryption is the control that makes stolen data useless to an attacker who has it. Data at rest — stored in databases, object storage, and file systems — should be encrypted by default, using provider-managed keys at minimum and customer-managed keys for the most sensitive data. Customer-managed keys give your organization cryptographic control over data even from the cloud provider, which matters for certain regulatory requirements and high-sensitivity data classifications.
Data in transit — moving between services, between cloud and on-premises systems, or between applications and end users — should use TLS 1.2 or 1.3. Unencrypted traffic between internal cloud services is a common configuration gap that many organizations overlook because it feels like an “internal” channel.
Identity and Access Management
IAM is where most cloud breaches are ultimately enabled, even when the initial attack vector is something else. Overly permissive roles, unused accounts that retain full access, service accounts with broad permissions, and a lack of separation between privileged and non-privileged functions all create conditions where a single compromised credential can reach far more data than the breach would otherwise have touched.
Practical IAM hygiene involves four things: applying least privilege consistently across all accounts and service roles, enforcing MFA on every account with any cloud access, regularly auditing access logs for unusual patterns, and removing or disabling accounts that are no longer needed. The last point is more important than it sounds — dormant accounts are a frequent initial access point because they are less monitored and more likely to use older, weaker credentials.
Continuous Monitoring and SIEM
The 241-day average breach lifecycle in IBM’s data reflects what happens when monitoring is reactive rather than continuous. Security Information and Event Management (SIEM) tools ingest logs from across cloud environments, correlate events across sources, and surface anomalies that would not be visible from reviewing any single log source. Without a SIEM or equivalent continuous monitoring capability, most breaches are discovered through external notification rather than internal detection — typically by a third party, a regulator, or the attackers themselves when they publish the data.
Cloud-native monitoring tools — AWS CloudTrail, Azure Monitor, Google Cloud Logging — capture the raw events. SIEM platforms add correlation and alerting. AI-powered security analytics add the anomaly detection layer that can surface behavioral patterns no predefined rule would catch. The combination of all three is what enables the faster detection that IBM’s data links to $1.9 million in average cost savings.
Zero Trust Architecture
Zero Trust is a security model built on the premise that no user, device, or system should be trusted by default, regardless of whether it is inside or outside the network perimeter. In a cloud environment where the traditional network perimeter does not exist — users access cloud services from home, from mobile devices, from partner networks — the perimeter-based security model that most traditional security controls were designed around simply does not apply.
Zero Trust replaces implicit trust with explicit verification at every access request: verify the identity, verify the device posture, verify the context of the request, and grant access only to the specific resource needed for that specific task. For organizations with hybrid or multi-cloud environments, Zero Trust is increasingly the practical architecture rather than a future aspirational state, because it is the only model that consistently applies across environments that do not share a network boundary.
Regular Backups and Isolated Recovery
Backups are the control that determines whether a ransomware incident is a recoverable operational disruption or a catastrophic data loss event. The critical requirement that many organizations miss is isolation: backups must be stored in environments that cannot be reached from the primary cloud infrastructure using the same credentials or network paths. Ransomware operators specifically seek out and encrypt backup targets during the dwell period before detonating the payload — backup targets that share access with production systems are routinely destroyed alongside the primary data.
The practical standard is the 3-2-1 backup rule: three copies of data, on two different storage types, with one copy offsite or in an isolated environment. For cloud environments, this typically means automated backups to a separate cloud account with independent access controls, verified through regular restore testing rather than assumed to be functional.
Compliance Frameworks That Apply to Cloud Data
For organizations in regulated industries, data security in cloud computing is not purely a technical decision — it is a compliance requirement with specific controls mandated by law or industry standard. The most commonly applicable frameworks for US-based organizations are HIPAA for healthcare data, PCI DSS for payment card data, SOC 2 for service organizations handling customer data, and GDPR for any organization handling data of EU residents regardless of where the organization is based.
Each framework specifies different technical controls, audit requirements, and breach notification timelines. HIPAA penalties can reach $2.13 million per violation category per year for willful neglect. GDPR fines under NIS2 can reach €10 million or 2 percent of global annual turnover. The regulatory component of breach cost is no longer a contingent risk — for any organization handling personal data at scale, a breach without adequate security controls now carries near-certain regulatory consequences.
Cloud providers offer compliance documentation and shared responsibility matrices that clarify which compliance controls the provider covers and which require customer implementation. These documents are the starting point for any cloud compliance program — not the endpoint. The provider covering the physical infrastructure security requirements of HIPAA does not mean your HIPAA program is complete. It means one layer of it is covered.
What Actually Reduces Breach Cost
IBM’s dataset provides unusually clear evidence on which security investments produce measurable cost reductions. The findings are consistent across years of data and worth taking seriously as budget justification.
AI and automation in security operations saves $1.9 million per breach on average and cuts detection time by 80 days — the largest single-variable cost reducer in IBM’s dataset. Extensive use of security AI (not just partial deployment) is required to realize the full benefit — organizations with limited AI deployment see smaller savings.
Organizations that involved law enforcement in ransomware incidents reduced breach costs by approximately $1 million compared to organizations that did not. This finding is counterintuitive to organizations that fear the reputational consequences of involving law enforcement, but the data consistently shows the cost reduction is real.
Phishing-resistant MFA deployment is the single highest-impact credential security control, directly addressing the attack vector responsible for the longest average breach lifecycle. The cost of deploying hardware security keys or FIDO2 passkeys across an organization is small relative to the average cost premium of a credential-based breach.
Staff security training that goes beyond annual checkbox compliance — including regular phishing simulations and practical security awareness for non-technical employees — addresses the human element responsible for 60 percent of breaches. The accounting clerk who opens a malicious attachment is a security risk that no technical control fully eliminates. Training is not a substitute for technical controls; it is the layer that reduces the effectiveness of the attacks that bypass technical controls.
For organizations building out their broader cloud infrastructure, our guide on cloud computing for small business covers the foundational platform decisions that security controls build on top of. And for teams evaluating AI security tools as part of their cloud security stack, our article on AI productivity tools updates 2026 covers the AI integration layer where shadow AI governance is becoming a security requirement.
Frequently Asked Questions
Is cloud computing secure for sensitive data?
Cloud computing can be secure for sensitive data when properly configured, monitored, and governed. Major cloud providers invest more in infrastructure security than most individual organizations can afford. The risk is not in the provider’s infrastructure — it is in how organizations configure cloud services, manage identities and access, and govern data. Misconfiguration and stolen credentials, both within the customer’s control, are responsible for the majority of cloud data breaches.
What is the shared responsibility model in cloud security?
The shared responsibility model divides security duties between the cloud provider and the customer. Providers are responsible for the physical infrastructure, networking hardware, and hypervisor layer — “security of the cloud.” Customers are responsible for their data, applications, identity and access management, and how cloud services are configured — “security in the cloud.” The exact split varies by service type: for infrastructure services (IaaS), customers own more of the stack; for managed software services (SaaS), the provider owns more. Understanding where the boundary falls for each service your organization uses is the foundation of any cloud security program.
What are the biggest cloud security threats in 2026?
The most significant cloud security threats in 2026 are misconfiguration (storage buckets and services left publicly accessible due to incorrect settings), stolen credentials (the costliest attack vector by detection-to-containment time), ransomware (present in 44 percent of breaches in 2025, increasingly targeting cloud backup infrastructure), insider threats (both malicious and negligent), and shadow AI (unsanctioned AI tools that expose sensitive data to third-party systems outside organizational security controls).
How much does a cloud data breach cost?
Breaches involving public cloud environments cost $5.17 million on average, and breaches spanning multiple cloud environments cost $5.05 million, according to IBM’s Cost of a Data Breach Report. For US organizations specifically, the average breach cost across all environments hit an all-time high of $10.22 million in 2025 — driven by regulatory fines, litigation exposure, and higher concentrations of healthcare and financial services organizations. The cost per compromised record averages $160, meaning a breach exposing 50,000 records could cost approximately $8 million in direct and indirect costs.
What is Zero Trust and why does it matter for cloud security?
Zero Trust is a security model that requires explicit verification of every access request — user, device, and context — regardless of whether the request originates inside or outside the network. In cloud environments where there is no traditional network perimeter, Zero Trust replaces the assumption that internal traffic is safe with continuous verification at every access point. It is particularly important for multi-cloud and hybrid environments where data moves between systems that do not share a network boundary.
How can organizations reduce cloud breach detection time?
The fastest path to reducing detection time is deploying AI-powered security analytics and continuous monitoring. IBM’s data shows organizations using AI in security operations detected breaches 80 days faster than those without, and saved $1.9 million per breach on average. Practically, this means deploying SIEM tools that ingest logs from all cloud services, adding AI-powered anomaly detection on top of rule-based alerting, and maintaining 24/7 monitoring coverage either internally or through a managed security service provider. The 241-day average breach lifecycle is not inevitable — it reflects what happens without automated detection.
What compliance frameworks apply to cloud data security?
The applicable frameworks depend on what kind of data you handle and where your customers are located. HIPAA applies to healthcare data in the US, with penalties reaching $2.13 million per violation category per year for willful neglect. PCI DSS applies to payment card data. SOC 2 applies to service organizations handling customer data and is increasingly required by enterprise customers as a baseline vendor security requirement. GDPR applies to any organization handling data of EU residents, regardless of where the organization is headquartered, with fines up to €20 million or 4 percent of global annual turnover. Cloud providers offer compliance documentation that clarifies which controls they cover — but provider coverage of infrastructure-level requirements does not complete your compliance program.
