Datadog’s State of Cloud Security 2026 report reinforces why limiting an attacker’s access matters as software flaws mount and long-lived AI keys persist.
Sydney, AUSTRALIA – 11 November 2026 — The median number of high or critical vulnerabilities in cloud services analysed by Datadog, Inc. (NASDAQ: DDOG) rose fourfold, from four in February 2026 to around 16 in November, according to its new State of Cloud Security 2026 report.
The findings show that the “vulnpocalypse” is more than a theoretical concern: cloud applications are carrying more serious known flaws, reinforcing the need for cloud security foundations that limit an attacker’s reach if an application is compromised.
Long-lived AI keys extend an attacker’s access
Limiting the impact of a compromised application also means protecting the keys it uses to reach other services. More than one in five organisations analysed by Datadog uses cloud AI services. To make these services easier to adopt, cloud providers offer long-lived API keys that can remain valid until revoked, giving an attacker more time to use them if stolen.
Datadog found that nearly half of organisations using Google Gemini use long-lived Gemini API keys, while 17 per cent of those using Amazon Bedrock use long-lived Bedrock API keys.
“Attackers don’t need to use their own AI model if they can steal the key used to access yours”, said Andrew Krug, Head of Security Advocacy at Datadog. “Teams should use temporary access wherever possible as they build AI applications, rather than leave behind keys that can keep working for years.”
Attackers are already testing stolen cloud credentials for AI access. Datadog Security Labs recently uncovered tools designed to test whether stolen AWS credentials can access Amazon Bedrock. Researchers also observed similar probing in 12 organisations’ cloud environments over a 30-day period.
Supply chain attacks provide another route to cloud credentials
The report reveals that cloud workloads depend on 149 software packages on average, more than half of which are indirect dependencies brought in through other packages. In addition, 60 per cent of organisations run cloud applications using a package version released less than 24 hours earlier. Across all cloud applications analysed, 21 per cent use a version this new.
While new packages are not inherently unsafe, the figures show how quickly a compromised version could reach cloud applications. The Shai-Hulud 2.0 malware shows the potential consequences: the malware searched infected systems for cloud credentials.
The report did, however, find signs of progress in limiting what an attacker can reach, even with a valid credential: 55 per cent of organisations using AWS have adopted data perimeters, up from 40 per cent in 2025.
“As serious flaws multiply, the question is how far an attacker can get through one compromised application,” said Emilio Escobar, Datadog’s Chief Information Security Officer. “Teams need to fix those flaws and limit the damage if an application is compromised. Temporary credentials and data perimeters can restrict an attacker’s access, while a shared view of applications, identities and infrastructure helps Security and Engineering contain an attack before it spreads. In the AI era, security becomes an observability problem: you can’t stop a system-wide attack without seeing the whole system.”
Yadi Narayana, Field CTO APJ at Datadog said, “The report broadly reflects what Datadog sees across Australia and New Zealand. Many organisations understand the risk, but long-lived credentials often remain hidden in older applications and integrations because teams fear disrupting critical services. Boards should treat software supply chain risk as a business resilience issue, not simply a technical problem. The priority is to identify every credential, understand what it can access, replace static keys where possible and monitor unusual activity across the full environment.”
Read the full State of Cloud Security 2026 report from Datadog here.
— ENDS —
About the research
For this report, Datadog analysed the cloud security posture of a sample of thousands of organisations. Data in this report has come from customers of Datadog Infrastructure Monitoring, Datadog Logs, and Datadog Cloud Security. The data is global in scope.
About Datadog
Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale. It brings applications, infrastructure, data, models, and security into one place, using AI to detect and resolve issues before they impact customers. Trusted globally by Fortune 500 companies and high-growth AI leaders, Datadog enables businesses to move faster with clarity and confidence.
PR Archives: Latest, By Company, By Date