A recent cybersecurity report has highlighted the growing scale of threats targeting cloud environments worldwide, recording 2.3 billion brute-force attempts, which rely on automated password guessing, alongside 1.7 billion exploitation attempts and 150 million reconnaissance events targeting cloud environments.
The report found that attackers’ use of artificial intelligence (AI) and automation to identify and exploit vulnerabilities has accelerated attacks and expanded their reach, leaving security teams with less time to detect and address threats before they cause significant operational and financial damage.
Accelerating attacks
According to Fortinet’s 2026 Cloud-Native Threat Landscape Report, AI and automation have helped reduce the time needed to exploit vulnerabilities from weeks to hours. Fortinet observed exploit activity within 24 to 48 hours of exploit code becoming available, highlighting how quickly attackers can exploit newly disclosed vulnerabilities.
This acceleration underscores the need to leverage AI and automation to strengthen threat response, enabling security teams to keep pace with attacks throughout application development, deployment, and runtime, while maintaining continuous security monitoring.
Identity compromise
Stolen or exposed credentials are among the main methods attackers use to access cloud environments while impersonating legitimate users. This makes it harder for organisations to distinguish malicious activity from normal user behavior.
These attacks rely on automated credential guessing, security misconfigurations, and weaknesses in cloud environments. Failure to enable multi-factor authentication (MFA), combined with excessive access privileges, further increases the risk of compromise. Organisations should therefore monitor account activity regularly and eliminate unnecessary privileges to protect sensitive data.
Security vulnerabilities
The report found that misconfigurations, excessive access privileges, and gaps in system monitoring can allow attackers to gain unauthorised access and cause damage with minimal effort. These risks are heightened by ongoing pressure to accelerate the release of applications and AI services.
The report emphasised the importance of implementing comprehensive cybersecurity controls throughout the application lifecycle, from development and deployment through to runtime. This includes continuously assessing weaknesses and identifying vulnerabilities that attackers can readily exploit.
Digital transformation
These measures are particularly important for Saudi Arabia’s digitally intensive sectors, including financial services, healthcare, energy, critical infrastructure, telecommunications, and government entities. As organisations expand their use of cloud computing and AI, robust security measures are essential to supporting the Kingdom’s digital transformation and the objectives of Saudi Vision 2030.
Financial losses
Attackers’ objectives extend beyond data theft to hijacking cloud computing resources for financial gain. This includes abusing cloud email services, conducting cryptocurrency mining, and exploiting AI services without authorisation.
The report warned that sudden, unexplained increases in cloud service consumption, computing resource usage, email activity, or AI service usage may indicate that systems have been compromised and their resources are being used without authorisation. Such activity can drive up operational costs and increase security risks.
Key defence priorities
The report identified three key priorities for strengthening cloud security: identifying and prioritising security risks for remediation; applying AI-native security throughout application development, deployment, and runtime, including threat response; and proactively testing the effectiveness of security measures.
Fortinet’s FortiCNAPP platform, designed to protect cloud-native applications, helps security teams identify active threats and high-risk vulnerabilities, allowing them to focus their efforts and resources on the most critical issues rather than becoming overwhelmed by unprioritised findings from traditional security scans.
Proactive security testing
The report recommended expanding security testing to include simulations of attacker techniques, testing applications at runtime, and identifying potential attack paths before adversaries can exploit them.
When integrated with FortiCNAPP and FortiAppSec Cloud, Fortinet’s FortiDAST solution for dynamic application security testing extends security testing to generative AI applications, focusing on the risks outlined in the OWASP Top 10 for Large Language Model Applications (OWASP LLM Top 10).
Fortinet’s FortiAIGate solution also provides dedicated capabilities for conducting penetration and stress testing of AI systems to assess their resilience against attacks.
Continuous protection
Drawing on threat intelligence data provided by the FortiCNAPP platform, the report concluded that attacks targeting cloud environments are increasingly continuous and automated.
This evolving threat landscape calls for stronger defences that can keep pace with the speed of attacks. Organisations must continuously reduce risk, remediate vulnerabilities, monitor for resource abuse, and accelerate threat detection and response to strengthen the security of digital environments.
Discussion about this post