Challenges
Keeping them at bay in a field as dynamic as cloud security requires staying up to date on the latest challenges and updating cloud security best practices to stay one step ahead of new threats. So, what do you need to look out for in the year ahead regarding cloud security?
Listed below are ten top cloud security challenges in 2025 to be aware of right now.
#1. AI-Generated Phishing Attacks
Generative AI has taken the world by storm in recent years, finding more and more use cases with each passing day. But while AI is redefining workflows for businesses, it is also becoming a valuable tool for criminals to wreak havoc. AI enables more sophisticated and scalable attacks, particularly social engineering attacks such as phishing emails.
The World Economic Forum’s 2025 Global Cybersecurity Outlook survey found that 47% of organizations cited advances in attacks due to generative AI as a primary concern. 42% reported a sharp increase in social engineering and phishing attacks in 2024.
Previously, criminals would blanket a large number of people with general-purpose phishing attacks that have a lower chance of succeeding. With lower-quality messaging, these were easier for recipients to spot. Containing unconvincing messaging that was not relevant to the recipient and maybe even contained basic grammar mistakes. Now, with generative AI, cybercriminals can quickly create more convincing messages to increase their chances of success. They can use AI to scrape data on their targets and personalize each email based on real-time information for much more sophisticated attacks.
Plus, with AI powering their operations, they can scale up and launch thousands of higher-quality, targeted email campaigns simultaneously. With the effective use of AI, even small criminal groups have the technology to mass-target your employees with personalized phishing emails. They only have to be effective once to compromise their credentials and gain unauthorized access to your cloud networks.
Organizations need new, more advanced methods to identify and mitigate the security risks from AI-generated phishing attacks. Detecting suspicious emails and blocking them before they arrive in employees’ inboxes as much as possible. Next, they should double down on training, giving employees the knowledge they need to avoid falling foul of social engineering attacks like phishing emails.
#2. Quantum Computing Risks
Quantum computing has the potential to break traditional encryption standards (e.g., AES, DES, RSA, etc.) exponentially faster than today’s computers. While the technology is yet to mature, some large tech companies like Google, Microsoft, and IBM are already offering quantum computing services.
These tend to be cloud services that allow customers to trial quantum algorithms, services where users can utilize quantum computing technology to attempt to simulate systems currently beyond the best high-performance traditional computing. Examples include some of the most complex problems such as drug discovery or material design.
Thankfully, we are still years away from functional, error-free quantum computers decrypting the world’s data. However, many organizations are already looking to implement new, more resistant cryptography techniques known as post-quantum cryptography (PQC). This is a particular concern for higher-risk industries with more sensitive datasets, such as healthcare and finance.
While our encryption standards are safe for now, hackers are potentially already intercepting and stockpiling data. By gathering encrypted data today they could decrypt it in the future, once quantum computing has advanced to the point where this task can be performed in a reasonable time. This potential security risk means many organizations are adopting PQC techniques as soon as possible.
#3. Attacks on Decentralized Cloud Storage Systems
While the cloud storage market is dominated by tech giants (Microsoft, Amazon, Google, etc.) providing centralized solutions, there is a growing trend towards a decentralized approach. This method encrypts and distributes data across various endpoints throughout the cloud rather than storing it all in a single centralized data center. Distributed cloud storage offers a range of potential benefits in terms of reduced costs, lower latency, and preventing vendor lock-in.
Proponents of decentralized storage also believe it enhances cloud security. Distributing data across the cloud does remove single points of failure. However, spreading your data across multiple systems also has the potential to increase your attack surface and introduce more vulnerabilities.
As the practice becomes more widespread, it will be interesting to see how vendors and customers manage the potential security risks.
#4. Ransomware-as-a-Service (RaaS)
Ransomware continues to be one of the most prevalent and lucrative forms of cybercrime. In 2023, extorted payments due to ransomware passed $1 billion for the year, the first time this has
happened.
With a lot of money to be made from unfortunate victims, the attack vector has grown into an industry, and cybercrime groups now offer “Ransomware-as-a-Service” (RaaS) products. As RaaS proliferates across the dark web, so does the number of attacks. As business data increasingly moves to the cloud, it makes sense that more ransomware attacks target cloud environments looking for potential weaknesses to gain unauthorized access and extract value.
To counter RaaS, businesses should adapt their security posture in 2025. RaaS users may have less technical expertise than previous attackers, but they are leading to more attacks than ever before. Generally speaking, this means businesses need to strengthen the reliability of their anti-ransomware technology and practices rather than their sophistication.
With enough obstacles between would-be hackers and your cloud applications, you can ensure RaaS users are kept at bay and maybe even deterred from targeting you at all.
#5. Data Residency and Localization Laws
Recent data privacy laws are placing a greater emphasis on residency and localization. Governments are putting rules in place on the physical location where data can be stored and processed. This could be requirements for businesses to store data within the country or region it was generated or making it more difficult to transfer data across borders to storage locations in different jurisdictions.
While these laws often only target industries with more sensitive data and greater regulation (e.g., health, finance, etc.), all businesses need to understand the data privacy laws where they operate. This includes ensuring their cloud service providers comply with the necessary regulations.
Security is a significant motivation for governments that enact data residency and localization laws. However, it can also complicate cloud security practices, with countries operating across multiple jurisdictions fragmenting their cloud storage. This inherently fragments their security strategies and limits access to data, potentially harming the work of IT teams.
#6. ESG Compliance in Cloud Operations
Environmental, social, and governance (ESG) guidelines are a framework for assessing the sustainability of a company’s practices. ESG compliance improves business reputation and can help attract customers and investors alike. Additionally, the framework and its recommendations are becoming law in more jurisdictions, meaning ESG-compliant companies avoid penalties for unsustainable practices.
The governance aspect of the framework impacts cloud operations and security, focusing on compliance and risk management while also ensuring transparency through auditing and reporting.
Other correlations between ESG sustainable business practices and cloud security include:
- Enforcing data encryption to protect privacy concerns.
- Reducing reputational risk from security breaches and unauthorized access to data.
- Implementing disaster recovery tools and guaranteeing business continuity.
#7. Cross-Jurisdictional Regulatory Challenges
An increasingly complicated regulatory landscape for data privacy continues to create cloud security challenges for companies. However, this is especially true for companies that want to do business in multiple parts of the world. Operating in different jurisdictions means implementing cloud security policies that adhere to various, sometimes conflicting, regulations. This is most prevalent in the US and Europe’s different approaches to data protection.
GDPR (General Data Protection Regulation) in Europe focuses on protecting personal data and getting consent for using it. In contrast, the US Cloud Act enables authorities to access data without permission, even if this data is stored overseas on the cloud. Therefore, European companies using US cloud services are potentially breaking GDPR as American authorities could monitor their data without seeking consent. Plus, the authorities don’t even need to inform affected parties.
To stay compliant with GDPR while using US cloud providers, European companies need to implement legal safeguards while conducting risk assessments of their specific American partners.
#8. Hybrid and Multi-Cloud Complexity
Many businesses operate with complex hybrid (mixture of private and public cloud services) or multi-cloud (two or more public cloud services) environments that create significant security challenges, such as:
- Visibility across the entire organization and preventing blind spots or inconsistencies.
- Enforcing uniform security policies across different cloud providers.
- Increasing your attack surface and the risk of misconfigurations, offering more potential entry points for hackers seeking unauthorized access to your data.
- Understanding where different cloud services store your data and ensuring compliance, following the proper regulations and data localization laws.
- Managing access controls and privileges across different cloud services.
- Integrating different security tools to prevent coverage gaps across various environments.
- Tracking shadow IT and unsanctioned SaaS apps that risk unauthorized access to your data.
- Ensuring proper incident response in mixed computing environments that lack centralized controls.
As more businesses undergo digital transformation and begin embracing the cloud (while maintaining some legacy infrastructure), the complexity of mixed computing environments is only going to increase.
IT teams must be confident in implementing a unified security framework across multi and hybrid cloud deployments. This includes multi-cloud security tools, advanced Data Loss Prevention (DLP) methods, and proper auditing to ensure compliance.
#9. Container Security
Containers provide agility, ensuring applications run the same regardless of the computing environment. However, they also introduce new attack vectors if misconfigured. A single container vulnerability can lead to attacks pivoting to the primary environment, enabling unauthorized access to your data for exfiltration or malware being delivered.
IT teams need to focus on container security in 2025 using:
- Trusted registries to scan images for vulnerabilities.
- Security tools to check for anomalies and provide runtime protection.
- Role-based-access-controls in orchestration systems like Kubernetes.
- Vaults to store credentials rather than container images.
- SBOMs (Software Bill of Materials) to mitigate against supply chain vulnerabilities.
#10. Serverless Architectures
Serverless architecture is growing in popularity among developers, shifting the responsibility of managing the backend entirely to cloud service providers. This approach offers a range of benefits to developers, increasing scalability and flexibility while potentially reducing costs and time to market. However, it also wholly shifts how the application is protected.
Serverless architecture doesn’t use firewalls or any server-based protection method. Security is not built around the application but is defined by permissions, behavioral analysis, and strong code. Serverless security must focus on:
- Maintaining least-privileged access.
- Ensuring code and IaaS integrity through consistent scanning.
- Runtime protection for malicious events.
Feedback