Tenable’s 2025 risk report exposes critical security risks in companies using cloud services

Tenable, an exposure management company that focuses on closing cybersecurity gaps in businesses, recently released a report detailing critical vulnerabilities and risks in the usage of cloud services to store data. 

The Tenable Cloud Security Risk Report 2025, compiled from telemetry scanned through Tenable Cloud Services from October 2024 through March 2025, also presents detailed explanations and suggested mitigation strategies for companies interested in minimising cloud vulnerabilities in their systems. 

Overall results

Alarmingly, the report found that businesses across Southeast Asia are increasingly working with cloud vulnerabilities that go unnoticed, putting them and their data at risk. At least 9% of all cloud repositories analysed for the study included restricted or confidential information. Though the number is deceptively small, the large volumes of data processed on a daily basis by cloud service providers means that it actually corresponds to a staggering amount of sensitive information being exposed. 

One in ten publicly accessible storage locations also holds sensitive data — in addition to the inherent security risks these breaches hold for organisations, this also puts many multinational corporations at risk of violating stringent data security protections and regulations in Southeast Asia. 

With Singapore’s strict data protection laws, including the Cybersecurity Act, Personal Data Protection Act (PDPA), and Monetary Authority of Singapore (MAS) Technology Risk Management Guidelines, companies in regulated sectors are at high risk of running afoul of the law if they fail to secure important data on their servers. This also stretches to companies that operate in the Southeast Asian region, as other countries like Indonesia, Philippines, Thailand and Malaysia have similar regulations that impose stringent requirements on data protection, cross-border transfers and data security. 

Not all is lost, though. At least 83% of organisations using Amazon Web Services (AWS) were found to have configured identity provider services (IdPs). They help prevent impersonation by acting as a central authentication service, managing and verifying the identities of those who can access sensitive information. However, the report also warned that IdPs are not a guarantee of security, and that they can still be exploited through other cloud weaknesses such as overly permissive defaults. 

The risks of AI

Information from the Tenable Cloud AI Risk Report 2025 was also cited in the article as an example of how AI developer tools and services, which are fast gaining popularity amongst companies, can also pose their own security risks and challenges. Though many companies rely on AI to process large amounts of data, the report found that 77% of the organisations utilising GCP’s Vertex AI Workbench had misconfigured defaults, which created high-risk exposure paths that could lead to compliance violations. 

Another problem found was that AI cloud workloads across Azure, AWS and GCP had higher rates of critical vulnerabilities, with 70% having at least one unremediated critical vulnerability, higher compared to the ‘preferable’ rate of 50% in non-AI workloads. These critical vulnerabilities raise the chances of successful cyberattacks and data leaks by bad agents. 

As the massive quantity of AI data means that a large percentage of it is likely to be sensitive, the report recommends that organisations take proactive steps to integrate special AI security measures and failsafes into their cybersecurity protocols, especially when integrating AI into company systems. 

Ari Eitan, Director of Cloud Security Research at Tenable, said on the report results, “In today’s threat landscape, complacency is costly. Organisations must treat secrets with the highest level of security hygiene to prevent attackers from gaining footholds that can spiral into full-blown breaches.”

“The cloud offers incredible agility, but without strong controls and continuous monitoring, it also opens the door to significant exposures,” Eitan added. “Understanding where your sensitive data and credentials are and who can access them must now be a board-level priority.”