Nearly each organisation working cloud-native programs has been hit by a safety incident up to now yr. The causes are much less dramatic than the frequency suggests, in line with Purple Hat’s 2026 State of Cloud-Native Safety Report, printed on March 24. It states that 97% of organisations reported no less than one cloud-native safety incident over the earlier 12 months.
As per the report’s findings, misconfigured infrastructure or companies had been probably the most generally reported incident sort at 78%, adopted by identified vulnerabilities and unauthorised entry. These will not be subtle, hard-to-anticipate assaults however execution failures – recurring and dear.
The report’s sharpest discovering is the space between how ready organisations imagine they’re and what their safety programmes can truly display. In accordance with the 2026 report, 56% of respondents described their day-to-day safety posture as proactive. But solely 39% reported having a mature, well-defined cloud-native safety technique, and round 22% had no outlined technique in any respect. Which means roughly six in ten organisations are working on confidence not construction.
The sensible penalties are evident within the uneven adoption of fundamental controls. As per the report, id and entry administration had roughly 75% adoption – one of many strongest figures within the survey. Container picture signing, nevertheless, had been applied by solely about half of organisations, and runtime safety remained inconsistent, with many groups defaulting to out-of-the-box settings not intentionally outlined insurance policies.
Based mostly on Purple Hat’s information, organisations with a well-defined technique reported 61% confidence in securing their software program provide chain, significantly larger than much less mature friends, and had been much more prone to have deployed superior guardrails of their environments.
Safety slows supply
In accordance with the report, 74% of organisations delayed or slowed software deployments up to now 12 months attributable to safety issues. Of those who reported downstream results – a determine that reached 92%– 52% stated remediation calls for had consumed extra time than deliberate, 43% reported decrease developer productiveness, and 32% stated incidents had broken buyer belief.
That sample – safety as a brake on supply – is what Purple Hat’s prescription is designed to interrupt. The report argues that embedding safety earlier and extra persistently into improvement pipelines reduces the remediation burden downstream, not including friction on the level of deployment.
AI’s governance drawback
The 2026 version of the report introduces a dimension that earlier variations didn’t should deal with at scale: the safety implications of generative AI inside cloud environments. In accordance with the report, 58% of organisations now determine AI adoption as a core driver of their safety planning.
The priority ranges are near-universal; 96% of respondents expressed worries about generative AI in cloud settings, with the principle fears centring on publicity of delicate information, shadow AI instruments deployed with out approval, and the combination of insecure third-party AI companies.
The governance response has not stored tempo. As per the report, 59% of organisations lack documented inside AI use insurance policies or governance frameworks, leaving the bulk managing an increasing and fast-moving set of AI instruments with out agreed-on guidelines for information dealing with, entry, or oversight.
Purple Hat has been working to increase zero-trust rules into the AI agent layer, particularly to deal with this. In January 2026, the corporate made its Zero Belief Workload Id Supervisor usually accessible on OpenShift, offering cryptographically verifiable identities to workloads utilizing the open SPIFFE and SPIRE requirements.
Purple Hat’s personal technical documentation on the discharge exhibits the software extends the identical id and entry controls utilized to human-driven processes to AI brokers working at runtime – protecting agent-to-agent and agent-to-tool interactions that conventional perimeter safety doesn’t attain.
Anjali Telang, senior principal product supervisor for OpenShift Safety and Id at Purple Hat, described the rationale: “Zero belief means you belief nobody, you at all times confirm, and then you definately base that verification on an id. With AI, we need to usher in the identical belief that we have already got constructed into the system, ensuring that belief interprets to AI workloads and AI brokers.”
In accordance with Purple Hat’s rising applied sciences group, writing in February 2026, agentic AI programs introduce what NIST 800-207 defines as a transaction boundary drawback – the place authentication usually occurs solely between the shopper and the agent platform, with no express belief established in subsequent downstream calls. Most safety breaches in recent times have exploited precisely these hidden belief assumptions between elements.
Based mostly on the 2026 report, organisations are altering safety funding away from level instruments and towards platform consolidation and integrating safety immediately into improvement workflows. The declared priorities for the subsequent one to 2 years embody DevSecOps automation, cited by over 60% of respondents, to maneuver from guide assessment gates to safety embedded as code inside CI/CD pipelines. Software program provide chain safety adopted at 56%, and runtime safety enlargement at 54%.
Regulatory strain is reinforcing these priorities. In accordance with the report, 64% of organisations stated they anticipate the EU Cyber Resilience Act to be a main think about shaping safety funding selections – a determine that implies compliance has moved from a trailing consideration to a boardroom driver.
Purple Hat’s general advice within the report is to ascertain an outlined technique, construct guardrails and automation into platforms not layering them on prime, prioritise provide chain integrity, and introduce AI governance now.
The info makes a transparent case that cloud-native safety’s main drawback in 2026 is the hole between the safety posture organisations imagine they’ve and the one their processes and governance buildings maintain.
Purple Hat is exhibiting on the Cyber Safety & Cloud Expo, a part of TechEx North America, on the San Jose McEnery Conference Centre, 18 – 19 Might 2026.
(Picture by Growtika)
See additionally: Cloud demand shifts towards AI as enterprise use deepens
Wish to be taught extra about Cloud Computing from trade leaders? Try Cyber Safety & Cloud Expo happening in Amsterdam, California, and London. The excellent occasion is a part of TechEx and is co-located with different main expertise occasions, click on right here for extra info.
CloudTech Information is powered by TechForge Media. Discover different upcoming enterprise expertise occasions and webinars right here.