On August 13, the Cloud Security Alliance published its Top Threats to Cloud Computing 2026 report, based on rankings from more than 500 industry experts. Two AI threats appeared for the first time: AI-enhanced attacks, ranked second, and AI system compromise, ranked sixth. Inadequate identity and access management took the top spot. The same month, CNBC reported that data breach notices in 2026 had already passed the previous year's total, with AI playing a growing role in attacks.
What Changed
The report notes that concerns about cloud providers' own infrastructure dropped off the list. The risk now sits in how organisations use the cloud: who and what has access, which third-party services they depend on, and how fast their environments change. The authors highlight that non-human identities, machine-to-machine connections and autonomous decisions have outgrown traditional oversight.
What to Fix First
- Identity: turn on multi-factor authentication everywhere, remove unused accounts, and give every person and service only the access it needs.
- Machine accounts and API keys: list them, give each an owner, store them in a secrets manager and rotate them regularly.
- AI features: treat model inputs as untrusted, limit what an AI feature can access or change, and log its actions.
- Third-party services: keep an inventory of the tools and libraries you rely on and review their access.
- Change control: make configuration changes through reviewed, repeatable processes rather than one-off edits.
The Takeaway
The biggest risks are no longer exotic. They come from access that grew faster than anyone's ability to oversee it, and AI accelerates both attackers and that sprawl. Getting identity and access right is still the highest-value security work most teams can do.