Cloud Security Isn't Just Failing—It's Being Outpaced

Something is breaking in cloud security—and not in a subtle way. According to Palo Alto Networks, the rate of serious cloud incidents didn’t just rise in 2024—it exploded, with a 388% increase in high-severity alerts. That’s not a spike; that’s a failure to keep pace.

Let’s make one thing clear: this isn't about more low-risk noise or harmless misconfigurations. While low-severity alerts barely budged (up just 10%) and medium-level issues rose modestly (21%), high-severity incidents jumped by 235%. The attacks aren’t just more common—they’re hitting harder and more effectively.

What’s behind the surge? It's not just human error or misconfigured settings anymore. It’s a shift in how the cloud is being targeted. The most common critical alerts aren’t static vulnerabilities—they’re live, runtime behaviors that show active exploitation:

➪ Nearly 25 daily alerts per organization for remote command line usage of serverless tokens.
➪ Over 21 suspicious mass downloads from cloud storage.
➪ Frequent disabling of delete protections, averaging more than 20 times per day.

Chained together, these events are a recipe for ransomware. A threat actor steals serverless credentials, moves laterally with ease, disables backup and delete safeguards, and downloads everything before you even know what hit you. These aren’t theoretical risks—they’re daily realities.

And this isn’t the only disturbing trend. Other red flags saw explosive growth too:

• A 305% increase in suspicious large-scale downloads.
• A 116% rise in "impossible travel" logins—like a single user signing in from New York and Singapore within minutes.
• A 60% jump in unusual API requests tied to controlling virtual machines from outside expected regions.

And yet, despite all of this, the lion’s share of attention in many cloud security setups still centers on Cloud Security Posture Management (CSPM)—which, let’s face it, is falling behind. CSPM is about identifying misconfigurations, not stopping attacks in progress. It's reactive, not responsive.

Runtime is where the real threat lives now. Nearly every top medium- and high-severity alert Palo Alto tracked occurred in runtime. Not in planning, not in setup—during execution.

Amiram Shachar, CEO of Upwind, laid it out bluntly at Cybertech Global 2025: the first wave of cloud security was CSPM—checklists and static scanning. The second wave, led by platforms like Wiz, added more context and clarity. But the third wave, which we’re living through now, is live monitoring and runtime protection. Real-time detection is no longer a nice-to-have—it’s a survival requirement.

As Shachar pointed out, while reading about new IngressNightmare vulnerabilities in NGINX, the threat landscape is shifting under our feet. Cloud security teams that haven’t caught up are already bleeding risk.

If you’re still obsessing over configuration checks while runtime threats explode, you're not doing cloud security—you’re doing cloud forensics. And by then, the damage is already done.

source