Datadog finds serious vulnerabilities in cloud workloads increase 4x in just nine months

Résumé détaillé

Datadog’s State of Cloud Security 2026 report reinforces why limiting an attacker’s access matters as software flaws mount and long-lived AI keys persist.

COMPANY NEWS: Datadog’s State of Cloud Security 2026 report reinforces why limiting an attacker’s access matters as software flaws mount and long-lived AI keys persist.

The median number of high or critical vulnerabilities in cloud services analysed by Datadog, Inc. (NASDAQ: DDOG) rose fourfold, from four in February 2026 to around 16 in November, according to its new State of Cloud Security 2026 report.

The findings show that the “vulnpocalypse” is more than a theoretical concern: cloud applications are carrying more serious known flaws, reinforcing the need for cloud security foundations that limit an attacker’s reach if an application is compromised.

Limiting the impact of a compromised application also means protecting the keys it uses to reach other services. More than one in five organisations analysed by Datadog uses cloud AI services. To make these services easier to adopt, cloud providers offer long-lived API keys that can remain valid until revoked, giving an attacker more time to use them if stolen.

Datadog found that nearly half of organisations using Google Gemini use long-lived Gemini API keys, while 17 per cent of those using Amazon Bedrock use long-lived Bedrock API keys.

“Attackers don’t need to use their own AI model if they can steal the key used to access yours”, said Andrew Krug, Head of Security Advocacy at Datadog. “Teams should use temporary access wherever possible as they build AI applications, rather than leave behind keys that can keep working for years.”

Attackers are already testing stolen cloud credentials for AI access. Datadog Security Labs recently uncovered tools designed to test whether stolen AWS credentials can access Amazon Bedrock. Researchers also observed similar probing in 12 organisations’ cloud environments over a 30-day period.

The report reveals that cloud workloads depend on 149 software packages on average, more than half of which are indirect dependencies brought in through other packages.

While new packages are not…

Début de l'article, extrait de iTWire. Pour lire la suite, ouvrez l'article chez le média.