Written by Kalle Bjorn, Sr. Director Systems Engineering at Fortinet
Cloud-native environments are vital to AI initiatives and business transformation. That also makes them high-value targets. Fortinet FortiCNAPP intelligence shows that threat actors are now using automated attack workflows to identify vulnerable deployments, breach them, and quickly turn access into profit.
The 2026 Cloud-Native Threat Landscape Report draws exclusively on FortiCNAPP intelligence to examine the scale of adversary activity, the paths attackers use, the gaps they exploit, and the actions security leaders must now take to strengthen cloud resilience and accelerate defender velocity. The findings reveal the global scale of intrusion attempts: 150 million reconnaissance events, 2.3 billion brute-force attempts, and 1.7 billion exploitation attempts. These figures show that cloud intrusion is no longer a series of isolated efforts. Attackers continuously map environments, test credentials, exploit exposed services, and rapidly advance toward their objectives.
AI and Automation Have Accelerated the Cloud Attack Chain
Threat actors are using AI and automation to identify vulnerabilities, exploit exposed services, and achieve their objectives at unprecedented speed and scale. For defenders, the primary consequence is a shrinking response window. Time-to-exploit has fallen from weeks to hours, leaving less time to detect and respond before material business impact occurs.
This speed is reshaping the cloud security operating model. Periodic assessments and siloed alerts cannot match industrialized, AI-driven adversary workflows. Security teams must also adopt AI-driven, automated workflows across the full application lifecycle—from code to cloud, identities, workloads, AI systems, data, supply chains, and runtime—to prevent, protect, and respond at machine speed.
Identity Compromise Now the Dominant Intrusion Path
Although the report identifies some regional differences, cloud intrusions largely follow a consistent global pattern, with identity compromise by far the dominant intrusion vector. Attackers use stolen, exposed, or misused credentials to gain access through legitimate access paths, often making their activity hard to distinguish from normal user behavior.
For security leaders, identity risk must be treated as a crucial part of the cloud attack surface. While strong authentication remains critical, it is only one layer. Organizations also need continuous visibility into effective permissions, excessive privileges, risky relationships among identities and resources, and unusual behavior after access is granted. A valid credential should not give an attacker an unobstructed path to sensitive data, services, or administrative control.
Missing Security Controls Accelerate Adversary Speed
The report also highlights that cloud environments repeatedly lack critical security controls. The pressure to release applications and AI services quickly can lead to misconfigurations, excessive permissions, exposed services, and visibility gaps. Each gap reduces the work adversaries need to move from initial access to impact.
These findings reinforce the value of consistent cyber hygiene across all cloud environments. Security controls must follow workloads from development through deployment and runtime, while teams continuously assess which weaknesses are exposed, reachable, and exploitable. This context helps organizations focus on the greatest risks.
Cloud Services Expand Monetization Options
While data exfiltration remains a top objective, many threat actors focus solely on hijacking cloud resources for direct financial gain. FortiCNAPP intelligence shows a consistent pattern of abuse of cloud email services, including Amazon Simple Email Service, cryptomining, and misuse of AI services such as Amazon Bedrock.
This has immediate operational and financial consequences. An unexpected increase in cloud, email, compute, or AI service consumption may be more than a cost-management issue. It can signal compromised cloud environments. AI-powered behavioral anomaly detection is now crucial for helping teams identify and contain abuse early, before costs and exposure can escalate.
Three Priorities for Breaking the Cloud Attack Chain
The report highlights three key priorities to narrow the widening gap between the speed of cloud intrusion and defender response:
- Continuously identify and prioritize exploitable risk: Continuous threat exposure management aggregates signals from cloud accounts, development pipelines, data stores, repositories, identities, and runtime activity. FortiCNAPP applies specialized AI models to this unified data lake of context, helping teams focus on top risks and active threats rather than getting lost in hundreds, if not thousands, of findings.
- Apply AI-native security from code to runtime to response: Prevention, protection, detection, and response must span the full application lifecycle. Fortinet supports this approach with the Fortinet AI-Native Security Fabric, with FortiCNAPP for code risks, cloud platform security, and runtime workload protection; FortiGate, FortiAppSec Cloud, and FortiAIGate for adaptive runtime protection; and the Fortinet agentic SOC platform for accelerated detection and response. FortiDeceptor adds early warning deception to expose suspicious activity before an intruder reaches higher-impact resources with zero false positives.
- Validate resilience through active testing: Static checks cannot uncover every runtime weakness. AI-driven red teaming and dynamic application security testing help organizations identify exploitable paths before attackers do. FortiDAST, integrated with FortiCNAPP and FortiAppSec Cloud, extends this testing to generative AI applications by hunting for OWASP LLM Top 10 vulnerabilities. FortiAIGate also conducts stress and pen testing against AI systems.
Strengthen Cloud Resilience without Slowing Innovation
A key takeaway from the 2026 Cloud-Native Threat Landscape Report is that adversaries are turning cloud intrusion into a continuous, automated workflow. Your cloud security must operate the same way: dynamically reduce risk, close the security gaps that make compromise easier, watch for resource abuse, and use broad context to act quickly against the threats that matter most.
