Roughly two-thirds of companies have suffered a business-critical app outage due to misconfigured security policies, a Cloud Security Alliance report found.
Dive Brief:
- Security policy misconfigurations are leading toapplication outages, failed audit findings and multiday remediation windows, according to a report from theCloud Security Alliance published in August. The report, commissioned by cybersecurity providerAlgoSec, is based on responses from515 IT and security professionalsto aMay 2026survey.
- Roughly two-thirds of businesses have experienced at least one business-critical application outage due to a misconfigured security policy in the last 12 months, the report found. Another92%said it was challenging to gain a comprehensive view of security policies across their cloud environments while only9% ofenterprises reported having security policy management integrated into workflows.
- “What was once primarily a network-configuration problem has become an application-connectivity problem,”Hillary Baron, AVP of research at the Cloud Security Alliance, said in apress releaseaccompanying the report. “The traditional, infrastructure-centric approach, defining policy device by device and rule by rule, is increasingly ill-suited to today’s environment.”
Dive Insight:
Security policies aren’t keeping pace with hybrid cloud strategies, which are gaining popularity to accommodate increased AI workloads across enterprises.
Eight in 10companies are reassessing their cloud plans toimprove support for AI, with CIOs looking at a mix of public cloud, private cloud, edge and sovereign environments, and colocation to help meet AI demands, according to anInformation Services Groupreport. Globalsovereign cloud spendalone is set to increase more than35%this year as companies seek to gain greater control over their cloud data, according toGartner.
Hybrid and multicloud strategies are today’s “operating reality for most enterprise applications,” according to the Cloud Security Alliance report. While half of business-critical applications are most often housed on-premises,53%are housed in multicloud environments. Another46%are kept in private cloud,29%in public cloud and36%in hybrid cloud.Most organizations manage security policiesacross more than one environment simultaneously, the report said.
When there is a misconfiguration issue, only48%of organizations said they could remediate the issue within three days, according to the report.
“The failures organizations are absorbing — outages, rollbacks, delayed releases, audit findings — are the downstream cost of managing a high-volume, high-consequence control surface largely by hand,” the report said. “This is the first movement of the story the data tells: manual policy management has crossed from inefficiency into operational risk.”
To address risks posed by manual security policy configurations, theCloud Security Alliancerecommends enterprises gain unified visibility across environments, followed by conducting a pre-change risk analysis. Automating routine policy changes will help reduce misconfigurations and shorten remediation windows, while continuous compliance assessment should replace periodic reviews, the report said.
