34% of organizations lack knowledge of cloud cybersecurity

According to Cado Security, incident response today is too time-consuming and manual, leaving organizations vulnerable to damage due to their inability to efficiently investigate and respond to identified threats.

Cloud Visibility Challenges

Incident response challenges are becoming even more complex as organizations rapidly adopt cloud and container-based technologies and pursue a multi-cloud strategy.

The report examines the critical role and challenges of incident response and uncovers widespread deficiencies that cause organizations to experience delays in incident resolution and fail to comply with regulatory requirements. The primary reason for this is a lack of visibility and control over cloud environments.

“A robust incident response program – especially one that includes the next generation of technology – is critical to protecting organizations from new threats,” said James Campbell, CEO of Cado Security. “However, as our recent report shows, organizations still lack optimized incident response strategies for cloud environments. The findings underscore that organizations urgently need new approaches to rapid investigation and response – not only to better address risk, but also to meet complex and ever-changing incident response reporting requirements around the world.”

Companies are struggling with the expansion of the scope of regulation

90% of organizations suffer damage before they can contain and investigate incidents. Organizations report that 23% of cloud alerts go uninvestigated due to various challenges and complexities.

A major factor in delays in investigations was the lack of visibility and control over cloud environments, caused by the following operational challenges: 82% of organizations report having to use multiple platforms and tools to conduct investigations in the cloud. In addition, 34% of organizations report limited cybersecurity knowledge specific to cloud technologies.

As regulatory reporting requirements evolve, organizations are challenged to accommodate the increasing volume and keep up with new regulations. 42% of organizations say the biggest compliance challenge, aside from cloud adoption, is a lack of data transparency, and 34% of respondents have been fined for failing to meet regulatory requirements.

Future strategies for cloud investigation and response

As organizations migrate to the cloud, they must adopt new technologies to better protect against evolving threats. The report found that organizations have slightly improved their ability to handle cloud investigations, with respondents saying that 23% of cloud alerts are never investigated, compared to over 33% in 2021.

The visibility challenges associated with investigation and response in the cloud are leading to an increasing reliance on forensics tools among organizations. To this end, 83% have allocated a budget for cloud forensics, highlighting the growing importance of forensic capabilities in managing cloud security.

While organizations try to lean on existing tools such as security orchestration, automation and response (SOAR) platforms to gain insight into cloud-based threats, the report found that incident response automation is twice as effective as SOAR in cloud investigations. While prioritizing the implementation of automation is essential, this automation must be customized explicitly for incident response rather than applying general automation solutions.