Tenable Finds AI Workloads Driving New Cloud Security Challenges
Cloud AI workloads riskier than traditional
with 70% containing critical vulnerabilities compared to 50% in non-AI
workloads
Bangalore, India – 2 July 2025 – Tenable®, the Exposure Management company, today
released its 2025 Cloud Security Risk Report, revealing that cloud workloads supporting
artificial intelligence (AI) initiatives are more vulnerable than traditional
workloads. The report found that 70 per cent of AI workloads across AWS, Azure
and GCP contain at least one unremediated critical vulnerability, compared to
50 per cent of non-AI workloads, highlighting the mounting risk as
organisations embed AI into their business operations.
AI workloads, with their vast training datasets and model
development processes, are an increasingly attractive target for threat actors.
The study found that 77 per cent of organisations using Google’s Vertex AI
Workbench had at least one notebook instance configured with an overprivileged
default service account, a misconfiguration that could open a gateway for
privilege escalation and lateral movement across cloud environments. As AI
adoption accelerates in India, the findings underscore the need for organisations
to embed security earlier into AI development lifecycles.
Tenable’s research also shows broader progress in cloud
risk management. Toxic cloud trilogies, workloads that are publicly exposed,
critically vulnerable, and highly privileged, fell to 29 per cent of
organisations surveyed, a nine-point improvement from 2024. Tenable’s
researchers attribute the nine-point decline to sharper risk-prioritisation
practices and wider use of cloud-native security tooling, yet warn that even a
single trilogy provides attackers with a fast lane to sensitive data.
Identity remains the foundation of a secure cloud environment. The report finds
that 83 per cent of AWS users have configured at least one identity provider
(IdP), a best practice for securing human and service identities. Yet, the
presence of identity-based risks persists. Credential abuse remains the most
common initial access vector, implicated in 22 per cent of breaches,
underscoring that simply adopting IdPs is not enough without strong enforcement
of multi-factor authentication and least-privilege principles.
As India plans to legislate AI and cloud-related
regulations with the Digital India Act, organisations must not wait for compliance norms to be
rolled out to protect their cloud AI workloads. Innovations in cloud AI space
are moving at a rapid pace. Without the right cloud security strategy,
organisations are at a serious risk of being attacked.
“Organisations have made real strides in tackling toxic
cloud risks, but the rise of AI workloads introduces a fresh wave of
complexity,” said Ari Eitan, Director of Cloud Security Research at Tenable.
“AI’s data-intensive nature, combined with persistent misconfigurations and
vulnerabilities, demands a new level of diligence. Exposure management gives
security teams the context they need to protect what matters most, including
the crown jewels hidden inside AI environments.”
The report reflects findings by the Tenable Cloud
Research team based on telemetry from workloads across diverse public cloud and
enterprise environments, analysed from October 2024 through March 2025. To download the report today,
please visit: 2025 Cloud Security Risk Report
About Tenable
Tenable® is the exposure management company, exposing and
closing the cybersecurity gaps that erode business value, reputation and trust.
The company’s AI-powered exposure management platform radically unifies
security visibility, insight and action across the attack surface, equipping
modern organizations to protect against attacks from IT infrastructure to cloud
environments to critical infrastructure and everywhere in between. By
protecting enterprises from security exposure, Tenable reduces business risk
for more than 44,000 customers around the globe. Learn more at tenable.com.