Sysdig reveals cloud security trends in new 2025 report

Sysdig has released its "2025 Cloud-Native Security and Usage Report," which explores the intricate landscape of cloud security, revealing key trends and challenges in enterprise security.

The report indicates a significant rise in AI and machine learning package use, which increased by 500% over the past year.

It observes that whilst the adoption of AI has surged, public exposure has decreased by 38%, indicating enhanced security measures.

Loris Degioanni, Sysdig Founder and Chief Technology Officer, commented, "It has been fascinating to watch cloud security evolve since we started reporting on usage eight years ago. When we first looked at container life spans in 2019, half lasted at least five minutes – today, 60% live for one minute or less."

"Given the short life span paired with how quickly attackers can move across cloud environments, I am encouraged to see defenders actively detecting and responding to threats in less than 10 minutes."

Security teams are now capable of detecting threats in under 5 seconds and responding within an average of 3.5 minutes, surpassing the 10-minute window attackers have exploited in the past.

The focus on real risk has led to a decline in in-use vulnerabilities to less than 6%, signifying a 64% improvement in vulnerability management over the past two years.

Open source tools, including Kubernetes, Prometheus, and Falco, are increasingly being utilised by organisations worldwide to secure their cloud infrastructure.

This usage highlights growing trust in open source security standards, with more than 60% of the Fortune 500 implementing these tools.

However, the report also highlights significant security challenges, especially with machine identities. Machine identities outnumber human identities by 40,000 times, and they pose a 7.5 times greater security risk. A substantial portion of breaches, nearly 40%, originate from credential exploitation.

The prevalence of short-lived containers, with 60% existing for one minute or less, points to increased application agility.

However, this also offers attackers a chance to identify and exploit vulnerabilities rapidly. The report identifies the need for real-time detection and response as more critical than ever.

The issue of bloated container images is highlighted, with such images enlarging the attack surface and creating operational inefficiencies. This calls for the need for more efficient container management to reduce unnecessary security risks.

Crystal Morin, Sysdig Cybersecurity Strategist, observed, "Cybersecurity has long been an arms race between threat actors and defenders, but the battlefield is evolving.

Organizations have made tremendous progress, and the fact that mature security teams can now respond to threats within minutes is a game-changer. But with machine identities multiplying and cloud environments evolving in real time, automation and rapid response have never been more mission-critical. The data in this report makes me optimistic about the future of cyberdefense."

The report also warns that attackers continue to exploit open source capabilities, such as open source malware and weaponising open source software, underscoring the dual nature of open source technology in the security landscape.