Blog
/
Cloud
/
December 5, 2024

Protecting Your Hybrid Cloud: The Future of Cloud Security in 2025 and Beyond

In the coming years, cloud security will not only need to adapt to increasingly complex environments as ecosystems become more distributed, but also to rapidly evolving threats like supply chain attacks, advanced misconfiguration exploits, and credential theft. AI-powered cloud security tools can help security teams keep up.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Kellie Regan
Director, Product Marketing - Cloud Security
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
05
Dec 2024

Cloud security in 2025

The future of cybersecurity is being shaped by the rapid adoption of cloud technologies.

As Gartner reports, “By 2027, more than 70% of enterprises will use industry cloud platforms to accelerate their business initiatives, up from less than 15% in 2023” [1].

As organizations continue to transition workloads and sensitive data to cloud environments, the complexity of securing distributed infrastructures grows. In 2025, cloud security will need to address increasingly sophisticated threats with innovative approaches to ensure resilience and trust.

Emerging threats in cloud security:

  1. Supply chain attacks in the cloud: Threat actors are targeting vulnerabilities in cloud networks, including third-party integrations and APIs. These attacks can have wide-spanning impacts, jeopardizing data security and possibly even compromising multiple organizations at once. As a result, robust detection and response capabilities are essential to identify and neutralize these attacks before they escalate.
  2. Advanced misconfiguration exploits: Misconfigurations remain a leading cause of cloud security breaches. Attackers are exploiting these vulnerabilities across dynamic infrastructures, underscoring the need for tools that provide continuous compliance validation in the future of cloud computing.
  3. Credential theft with evolving Tactics, Techniques, and Procedures (TTPs): While credential theft can result from phishing attacks, it can also happen through other means like malware, lateral movement, data breaches, weak and reused passwords, and social engineering. Adversarial innovation in carrying out these attacks requires security teams to use proactive defense strategies.
  4. Insider threats and privilege misuse: Inadequate monitoring of Identity and Access Management (IAM) in cloud security increases the risk of insider threats. The adoption of zero-trust architectures is key to mitigating these risks.
  5. Threats exploiting dynamic cloud scaling: Attackers take advantage of the dynamic nature of cloud computing, leveraging ephemeral workloads and autoscaling features to evade detection. This makes adaptive and AI-driven detection and response critical because it can more easily parse behavioral data that would take human security teams longer to investigate.

Where the industry is headed

In 2025, cloud infrastructures will become even more distributed and interconnected. Multi-cloud and hybrid models will dominate, so organizations will have to optimize workloads across platforms. At the same time, the growing adoption of edge computing and containerized applications will decentralize operations further. These trends demand security solutions that are agile, unified, and capable of adapting to rapid changes in cloud environments.

Emerging challenges in securing cloud environments

The transition to highly distributed and dynamic cloud ecosystems introduces the following key challenges:

  1. Limited visibility
    As organizations adopt multiple platforms and services, gaining a unified view of cloud architectures becomes increasingly difficult. This lack of visibility makes it unclear where sensitive data resides, which identities can access it and how, and if there are potential vulnerabilities in configurations and API infrastructure. Without end-to-end monitoring, detecting and mitigating threats in real time becomes nearly impossible.
  2. Complex environments
    The blend of public, private, and hybrid clouds, coupled with diverse service types (SaaS, PaaS, IaaS), creates a security landscape rife with configuration challenges. Each layer adds complexity, increasing the risk of misconfigurations, inconsistent policy enforcement, and gaps in defenses – all of which attackers may exploit.
  3. Dynamic nature of cloud
    Cloud infrastructures are designed to scale resources on demand, but this fluidity poses significant challenges to threat detection and incident response. Changes in configurations, ephemeral workloads, and fluctuating access points mean that on-prem network security mindsets cannot be applied to cloud security and many traditional cloud security approaches still fall short in addressing threats in real time.

Looking forward: Protecting the cloud in 2025 and beyond

Addressing these challenges requires innovation in visibility tools, AI-driven threat detection, and policy automation. The future of cloud security hinges on solutions that adapt to complexity and scale, ensuring organizations can securely navigate the growing demands of cloud-first operations.

Unsupervised Machine Learning (ML) enhances cloud security

Unlike supervised ML, which relies on labeled datasets, unsupervised ML identifies patterns and deviations in data without predefined rules, making it particularly effective in dynamic and unpredictable environments like the cloud. By analyzing the baseline behavior in cloud environments, such as typical user activity, network traffic, and resource utilization, unsupervised ML and supporting models can identify behavioral deviations linked to suspicious activity like unusual login times, irregular API calls, or unexpected data transfers, therefore flagging them as potential threats.

Learn more about how multi-layered ML improves real-time cloud detection and response in the data sheet “AI enhances cloud security.

Agent vs. Agentless deployment

The future of cloud security is increasingly focused on combining agent-based and agentless solutions to address the complexities of hybrid and multi-cloud environments.

This integrated approach enables organizations to align security measures with the specific risks and operational needs of their assets, ensuring comprehensive protection.

Agent-based systems provide deep monitoring and active threat mitigation, making them ideal for high-security environments like financial services and healthcare, where compliance and sensitive data require stringent safeguards.

Meanwhile, agentless systems offer broad visibility and scalability, seamlessly covering dynamic cloud resources without the need for extensive deployment efforts.

Together, a combination of these approaches ensures that all parts of the cloud environment are protected according to their unique risk profiles and functional requirements.

The growing adoption of this strategy highlights a shift toward adaptive, scalable, and efficient security solutions, reflecting the priorities of a rapidly evolving cloud landscape.

To learn more about how these technologies are reshaping cloud defenses, read the blog “Agent vs. Agentless Cloud Security: Why Deployment Methods Matter.”

Shifting responsibilities: security teams must get more comfortable with cloud mindsets

Traditionally, many organizations left cloud security to dedicated cloud teams. However, it is becoming more and more common for security teams to take on the responsibilities of securing the cloud. This is also true of organizations undergoing cloud migration and spinning up cloud infrastructure for the first time.

Notably, the usual approaches to other types of cybersecurity can’t be applied the exact same way to the cloud. With the inherent dynamism and flexibility of the cloud, the necessary security mindset differs greatly from those for the network or datacenters, with which security teams may be more familiar.

For example, IAM is both critical and distinct to cloud computing, and the associated policies, rules, and downstream impacts require intentional care. IAM rules not only govern people, but also non-human entities like service accounts, API keys, and OAuth tokens. These considerations are unique to cloud security, and established teams may need to learn new skills to reduce security gaps in the cloud.

Discover more about the teams that impact modern cloud security in the blog "Cloud Security Evolution: Why Security Teams are Taking the Lead."

The importance of visibility: The future of network security in the cloud

As organizations transition to cloud environments, they still have much of their data in on-premises networks, meaning that maintaining visibility across both on-premises and cloud environments is essential for securing critical assets and ensuring seamless operations. Without a unified security strategy, gaps between these infrastructures and the teams which manage them can leave organizations vulnerable to cyber-attacks.

Shared visibility across both on-premises and cloud environments unifies SecOps and DevOps teams, enabling them to generate actionable insights and develop a cohesive approach. This alignment helps confidently mitigate risks across the cloud and network while streamlining workflows and accelerating the cloud migration journey—all without compromising security or operational continuity.

Read more about the importance of end-to-end visibility in the modern threat landscape in the blog "Breaking Silos: Why Unified Security is Critical in Hybrid World."

Cloud security ciso's guide screenshot

Ready to transform your cloud security approach? Download the CISO's Guide to Cloud Security now!

References:

[1] Gartner, June 5, 2024, “The Expanding Enterprise Investment in Cloud Security,” Available at: https://www.gartner.com/en/newsroom/press-releases/2024-06-05-the-expanding-enterprise-investment-in-cloud-security

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Kellie Regan
Director, Product Marketing - Cloud Security

More in this series

No items found.

Blog

/

Email

/

June 18, 2025

Darktrace Collaborates with Microsoft: Unifying Email Security with a Shared Vision

Default blog imageDefault blog image

In today’s threat landscape, email remains the most targeted vector for cyberattacks. Organizations require not only multi-layered defenses but also advanced, integrated systems that work collaboratively to proactively mitigate threats before they cause damage

That’s why we’re proud to announce a new integration between Darktrace / EMAIL and Microsoft Defender for Office 365, delivering a Unified Quarantine experience that empowers security teams with seamless visibility, control, and response across both platforms.

This announcement builds on a strong and growing collaboration. In 2024, Darktrace was honored as Microsoft UK Partner of the Year and recognized as a Security Trailblazer at the annual Microsoft Security 20/20 Awards, a testament to our shared commitment to innovation and customer-centric security.

A Shared Mission: Stopping Threats at Machine Speed

This integration is more than a technical milestone,as it’s a reflection of a shared mission: to protect organizations from both known and unknown threats, with efficiency, accuracy, and transparency.

  • Microsoft Defender for Office 365 delivers a comprehensive security framework that safeguards Microsoft 365 email and collaboration workloads leveraging advanced AI, global threat intelligence and information on known attack infrastructure.
  • Darktrace / EMAIL complements this with Self-Learning AI that understands the unique communication patterns within each organization, detecting subtle anomalies that evade traditional detection methods.

Together, we’re delivering multi-layered, adaptive protection that’s greater than the sum of its parts.

“Our integration with Microsoft gives security teams the tools they need to act faster and more precisely to detect and respond to threats,” said Jill Popelka, CEO of Darktrace. “Together, we’re strengthening defenses where it matters most to our customers: at the inbox.”

Unified Quarantine: One View, Total Clarity

The new Unified Quarantine experience gives customers a single pane of glass to view and manage email threatsregardless of which product took action. This means:

  • Faster investigations with consolidated visibility
  • Clear attribution of actions and outcomes across both platforms
  • Streamlined workflows for security teams managing complex environments

“This integration is a testament to the power of combining Microsoft’s global threat intelligence with Darktrace’s unique ability to understand the ‘self’ of an organization,” said Jack Stockdale, CTO of Darktrace. “Together, we’re delivering a new standard in proactive, adaptive email security.”

A New Era of Collaborative Cyber Defense

This collaboration represents a broader shift in cybersecurity: from siloed tools to integrated ecosystems. As attackers become more sophisticated, defenders must move faster, smarter, and in unison.

Through this integration, Darktrace and Microsoft establish a new standard for collaboration between native and third-party security solutions, enhancing not only threat detection but also comprehensive understanding and proactive measures against threats.

We’re excited to bring this innovation to our customers and continue building a future where AI and human expertise collaborate to secure the enterprise.

[related-resource]

Continue reading
About the author
Carlos Gray
Senior Product Marketing Manager, Email

Blog

/

Network

/

June 19, 2025

Customer Case Study: Leading Petrochemical Manufacturer

Default blog imageDefault blog image

Headquartered in Saudi Arabia, this industry leading petrochemical manufacturer serves customers in more than 80 countries across diverse markets throughout Europe, Africa, Latin America, the Middle East, China, and Southeast Asia.

Cyber resiliency critical to growth strategy

This leading petrochemical manufacturer’s vision is to be one of the major global players in the production and marketing of designated petrochemicals and downstream products. The company aims to significantly increase its capacity to up to a million metric tons within the next few years.

With cyber-attacks on critical infrastructure increasing 30% globally last year, cyber resiliency is essential to supporting the company’s strategic business goals of:

  • Maximizing production through efficient asset utilization
  • Maximizing sales by conducting 90% of its business outside Saudi Arabia
  • Optimizing resources and processes by integrating with UN Global Compact principles for sustainability and efficiency
  • Growing its business portfolio by engaging in joint ventures to diversify production and add value to the economy

However, the industry leader faced several challenges in its drive to fortify its cybersecurity defenses.

Visibility gaps delay response time

The company’s existing security setup provided limited visibility to the in-house security team, hindering its ability to detect anomalous network and user activity in real time. This resulted in delayed responses to potential incidents, making proactive issue resolution difficult and any remediation in the event of a successful attack costly and time-consuming.

Manual detection drains resources

Without automated detection and response capabilities, the organization’s security team had to manually monitor for suspicious activity – a time-consuming and inefficient approach that strained resources and left the organization vulnerable. This made it difficult for the team to stay current with training or acquire new skills and certifications, which are core to the ethos of both the company’s owners and the team itself.

Cyber-attacks on critical infrastructure increasing

The petrochemical manufacturer is part of a broader ecosystem of companies, making the protection of its supply chain – both upstream and downstream – critical. With several manufacturing entities and multiple locations, the customer’s internal structure is complex and challenging to secure. As cyber-attacks on critical infrastructure escalate, it needed a more comprehensive approach to safeguard its business and the wider ecosystem.

Keeping and growing skills and focus in-house

To strengthen its cybersecurity strategy, the company considered two options:

  1. Make a significant initial and ongoing investment in a Security Operations Center (SOC), which would involve skills development outside the company and substantial management overhead.
  2. Use a combination of new, automated tools and an outsourced Managed Detection and Response (MDR) service to reduce the burden on internal security specialists and allow the company to invest in upskilling its staff so they can focus on more strategic tasks.

Faced with this choice between entirely outsourcing security and augmenting the security team with new capabilities, the customer chose the second option, selecting Darktrace to automate the company’s monitoring, detection, and response. Today, the petrochemical manufacturer is using:

Extending the SOC with 24/7 expert support

To alleviate the burden on its lean security team, the company augmented its in-house capabilities with Darktrace’s Managed Detection & Response service. This support acts as an extension of its SOC, providing 24/7 monitoring, investigation, and escalation of high-priority threats. With Darktrace’s global SOC managing alert triage and autonomously containing threats, the organization’s internal team can focus on strategic initiatives. The result is a stronger security posture and increased capacity to proactively address evolving cyber risks – without expanding headcount or sacrificing visibility.

A unique approach to AI

In its search for a new security platform, the company’s Director of Information Technology said Darktrace’s autonomous response capability, coupled with Self-Learning AI-driven threat reduction, were two big reasons for selecting Darktrace over competing products and services.

AI was a huge factor – no one else was doing what Darktrace was doing with [AI].”

Demonstrated visibility

Before Darktrace, the customer had no visibility into the network activity to and from remote worker devices. Some employees need the ability to connect to its networks at any time and from any location, including the Director of Information Technology. The trial deployment of Darktrace / ENDPOINT was a success and gave the team peace of mind that, no matter the location or device, high-value remote workers were protected by Darktrace.

Modular architecture  

Darktrace's modular architecture allowed the company to deploy security controls across its complex, multi-entity environment. The company’s different locations run on segregated networks but are still interconnected and need to be protected. Darktrace / NETWORK provides a unified view and coordinated security response across the organization’s entire network infrastructure, including endpoint devices.

Results

The petrochemical manufacturer is using Darktrace across all of its locations and has achieved total visibility across network and user activity. “Darktrace is increasing in value every day,” said the Director of Information Technology.

I don’t have a big team, and Darktrace makes our lives very, very easy, not least the automation of some of the tasks that require constant manual review.”

Time savings frees analysts to focus on proactive security

Darktrace / NETWORK provides continuous, AI-driven monitoring and analysis of the company’s network activity, user behavior, and threat patterns, establishing a baseline of what normal activity looks like, and then alerting analysts to any deviations from normal traffic, activity, and behaviors. Darktrace’s autonomous response capabilities speed up response to detected threats, meaning intervention from the security team is required for fewer incidents and alerts.

In October 2024 alone, Darktrace Cyber AI Analyst saved the team 810 investigation hours, and autonomously responded to 180 anomalous behaviors that were uncovered during the investigations. With Darktrace managing the majority of threat detection and response efforts, the security team has been able to change its day-to-day activity from manual review of traffic and alerts and belated response to activity, to proactively fortifying its detection and response posture and upskilling to meet evolving requirements.  

Layered email protection reduces phishing threats

The company’s email infrastructure posed a challenge due to petrochemical industry regulations requiring on-premises email servers, with some security delivered via Microsoft Azure. By integrating Darktrace / EMAIL into the Azure stack, the organization has reduced the volume of phishing emails its users receive by 5%.

“Now we have one more layer of security related to email – every email goes through two filters. If something is not being caught or traced by Azure, it is being detected by Darktrace,” said the Director of Information Technology. “As a result, we’re now seeing only about 15% to 20% of the phishing emails we used to receive before implementing Darktrace.”

Preparing for a secure future

The time saved using Darktrace has helped the security team take proactive steps, including preparing for new cyber resilience regulations for Saudi Arabia’s Critical National Infrastructure, as mandated by the National Cybersecurity Authority (NCA).

“The team now has ample time to prepare policies and procedures that meet the new NCA regulations and, in some cases, enhance the requirements of the new law,” said the Director of Information Technology. “All of this is possible because they don’t need to keep watch; Darktrace takes on so much of that task for them.”

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI