Cloud security skills gap widens as AI adoption surges

Fortinet has published survey findings that point to a growing "complexity gap" in cloud security as more organisations run hybrid and multi-cloud environments and face skills shortages and faster-moving threats.

The 2026 State of Cloud Security Report draws on a survey of 1,163 senior cybersecurity leaders and professionals worldwide. Fortinet said the data shows a widening mismatch between the pace of change in cloud environments and security teams' ability to maintain consistent visibility, detection and response.

Hybrid uptake

The report found that 88% of organisations now operate in hybrid or multi-cloud environments. Fortinet said the figure rose from 82% in the prior year's survey.

Among respondents running hybrid or multi-cloud deployments, 81% said they rely on two or more cloud providers for critical workloads. Fortinet said 29% reported using more than three providers.

Fortinet linked the trend to the operational complexity of cloud estates. It cited distributed architectures, dynamic identities and expanding services. It also pointed to the mix of public clouds, on-premises infrastructure, Software-as-a-Service applications and distributed users and devices.

Three drivers

Fortinet said three factors reinforced what it described as the complexity gap. The first was fragmented defences. It said cloud adoption often expands faster than security coordination across teams and tools.

The report said disconnected tools can lead to inconsistent controls and limited end-to-end visibility. It also said security teams may need to manually correlate alerts across systems that were not designed to work together. Fortinet said almost 70% of organisations identified tool sprawl and visibility gaps as the leading obstacles to an effective cloud security approach.

The second factor focused on staffing. Fortinet said organisations struggle to hire and retain cybersecurity professionals with the right skills. It described teams as stretched thin across multiple tools and environments.

In the survey, 74% of respondents reported an active shortage of qualified cybersecurity professionals. Fortinet also said 59% of respondents remained in the early stages of cloud security maturity.

The third factor involved adversaries using automation and AI. Fortinet said attackers now move faster in cloud environments. It said they use automation to find misconfigurations, map permission paths and identify exposed data.

The report also highlighted confidence levels among defenders. It said more than 80% of cybersecurity experts surveyed lacked strong confidence in their ability to detect and respond to cloud threats in real time. Fortinet said this represented a 16-point increase compared with last year's survey results.

AI pressure

Fortinet placed AI adoption at the centre of the security challenge. It said AI changes how organisations manage cloud environments and increases the number of assets and services that security teams need to monitor.

"As more enterprises catapult into an AI-powered future, cloud security is more critical than ever to an organization's success and, perhaps even, survival. The velocity of AI adoption is fundamentally changing how cloud environments are managed and expanding the attack surface at a speed that outpaces traditional security models and teams' ability to protect modern deployments," said Vincent Hwang, Vice President, Cloud Security, Fortinet.

Fortinet also said the gap did not reflect a lack of spending. It said cybersecurity spending is increasing but that maturity and effectiveness do not keep pace with new use cases. It also noted that many use cases now include an AI element.

Consolidation trend

The report pointed to a shift in how organisations think about cloud security tooling. Fortinet said respondents showed growing interest in unified security ecosystems rather than function-specific point tools managed in isolation.

In the survey, 64% of respondents said that if they were starting from scratch they would design their cybersecurity strategy around a single-vendor platform that unites network, cloud and application security. Fortinet attributed the preference to the integration work required to manage multiple vendors and products.

Fortinet also said respondents want fewer platforms and a stronger level of coordination. It said teams looked for shared data models and coordinated enforcement across systems.

Operational focus

Fortinet said organisations should focus on issues including hypergrowth, fragmentation, a limited number of employees with cybersecurity expertise and AI-driven threats. It also linked these priorities to organisations pursuing AI strategies and the need for security foundations and operational practices that match the speed of change in cloud environments.