Tenable Cloud Security Risk Report 2025

The Tenable Cloud Security Risk Report 2025 explores a broad range of exposures in cloud environments that can potentially increase risk for organizations. We examine the concerning ways some organizations are storing sensitive data and secrets — such as encryption keys, tokens or access keys that authenticate, authorize and encrypt data. We explore the prevalence of toxic cloud trilogies — workloads that simultaneously have a critical vulnerability, excessive permissions and public exposure.

We analyze trends we’re seeing in identity provider (IdP) services and discuss how organizations might extend this best practice to further alleviate risks, including credential abuse. And we revisit key findings from our Cloud AI Risk Report 2025 concerning the use of AI developer tools and services. Last, we offer mitigation advice to help organizations address these challenges in their cloud environments.

Tenable Cloud Research created this report by gathering and analyzing the telemetry from workloads across diverse public cloud and enterprise environments, scanned using the Tenable Cloud Security platform between October 2024 and March 2025. (The AI findings cited here are from data collected between December 2022 and November 2024.)

This report provides a deep dive into the most pressing cloud security issues observed, highlighting the areas of data, identity, workload and AI, and offers mitigation guidance for organizations seeking