Artificial intelligence has emerged as a top cloud security concern alongside longstanding problems involving identity and access management, third-party resources and APIs, according to the Cloud Security Alliance’s “Top Threats to Cloud Computing Survey Report 2026.”

Based on a survey of 507 security professionals, inadequate identity and access management (IAM) ranks as the top concern, while AI-enhanced attacks debuted at No. 2. Insecure third-party resources rank third, followed by insecure interfaces and APIs and misconfiguration and inadequate change control. A second new AI category, AI system compromise, ranks sixth.

The rankings reflect organizations’ growing reliance on AI, APIs, third-party services and automation as they seek to move faster and connect more business processes, explained Michael Roza, a CSA Research Fellow, co-chair of the Top Threats Working Group and a lead author of the report.

“Each choice changes the security problem,” Roza said. “More automation creates more non-human identities that have to be managed. More APIs create more connections and paths into systems. Greater use of third parties puts more data and business processes outside an organization’s direct control.”

Every service, API, workload, AI agent and automated process requires authentication and some level of permission, Roza said. As those identities multiply, organizations face greater difficulty determining what has access, whether that access remains necessary and how it is being used.

Andy Ruth, a research analyst with CSA, said organizations already understand many of the measures needed to improve IAM, including multifactor authentication and moving away from passwords. Executive sponsorship and balancing security with usability remain challenges.

AI compounds the IAM challenge because non-human identities can be created, used and deleted within short periods, requiring more advanced logging and management, Ruth said.

Why cloud security risks are expanding in 2026

The changing rankings reflect differences in how organizations are operating in the cloud compared with when CSA conducted its 2024 survey.

“In 2026, cloud security is dealing with a different operating environment than it was in 2024,” Roza said. “AI has moved from experimentation into business operations, automation is taking on more work, and organizations are connecting more of their systems to outside services.”

Those connections give attackers additional avenues through identities, APIs, AI systems and trusted third parties. Roza said the change in rankings reflects an environment with more services and systems that must be connected, authorized, monitored and governed.

“The infrastructure still matters, but increasingly the attack path runs through the things connected to it,” he said.

Ruth compared the current period with the earlier adoption of cloud computing, which took several years before organizations understood the security approaches and patterns well enough to operationalize secure environments. He said the key question is how long that cycle will take with AI.

AI creates two distinct cloud security risks

AI’s appearance in two separate categories reflects different security concerns surrounding the technology.

Ruth attributed the prominence of AI risk to the pace at which its capabilities and use have advanced. Security discussions have already progressed from generative AI to agentic systems, while organizations, service providers and threat actors are adopting the technology.