Cloud environments are now a primary target because they host large volumes of critical data and business applications. Several trends stand out:

• Rising attack volume and cost:
  
  • Microsoft Entra data shows more than 600 million identity cyberattacks per day in 2024.
  • Phishing attacks grew by 58% in 2023, making them one of the fastest-growing threats.
  • The average multicloud estate has about 351 exploitable attack paths leading to high-value assets.
  • In June 2024, 80% of organizations were found to have attack paths exposing critical assets.
• Nation-state and advanced actors:
  Nation-state groups use zero-day exploits, spear phishing, and malware to target software, cloud services, and supply chains. Sectors like IT, Education and Research, and Governments are especially targeted.
• Cloud misconfiguration:
  Simple issues—like default settings left unchanged, unrestricted ports, or unsecured backups—can expose cloud data and services to attackers.
• DDoS (Distributed Denial of Service):
  Network DDoS attacks have increased, with a rise beginning in mid-March 2024 and reaching about 4,500 attacks per day in June. These attacks are often disguised as legitimate traffic, making them harder to detect.
• Cloud Account Takeover (ATO):
  Account takeover is growing across banking, social media, and gaming. Attackers combine phishing with automated bots to compromise user accounts at scale.
• Fraud and financial impact:
  Annual losses from global e-commerce payment fraud are projected to surpass $90 billion by 2028, underscoring the financial stakes of weak cloud and identity security.

For most organizations, the challenge is not just individual threats, but how these issues intersect across identity, applications, networks, and data in a multicloud environment.

The source outlines six practical best practices you can adapt to your own environment:

1. Prioritize security from day one
   Embed security into your architecture and development lifecycle instead of bolting it on later. Use structured frameworks (for example, the Azure Well-Architected Framework) to define governance, secure configurations, and risk management early.
2. Unify your security management tools
   A fragmented toolset creates blind spots. A cloud-native application protection platform (CNAPP) can give you end-to-end visibility across multicloud and hybrid workloads, helping you close gaps and coordinate response. Solutions like Microsoft Sentinel support this unified approach.
3. Strengthen identity and access controls
   
   • Enforce phishing-resistant multifactor authentication (MFA).
   • Regularly review and right-size access permissions.
   • Use a centralized identity platform (such as Microsoft Entra ID) to manage identities, access policies, and identity threat protection.
4. Encrypt data at every stage
   Treat data as a core asset and encrypt it at rest, in transit, and in use. Use key management services (for example, Azure Key Vault) to manage cryptographic keys securely. For AI and data-intensive workloads, confidential computing can help keep data private even during processing.
5. Fortify your network defenses
   
   • Deploy advanced firewalls and always-on DDoS protection.
   • Continuously monitor network traffic and configurations.
   • Benchmark your setup against guidance such as the Microsoft cloud security benchmark to stay aligned with current best practices.
6. Design secure applications from the ground up
   Encourage close collaboration between development and security teams. Use controlled environments (for example, Azure Dev Test Labs) to test and validate security before deployment, and tools like GitHub Advanced Security to help keep vulnerabilities out of your codebase.

These steps help you reimagine cloud security as an integrated, continuous practice—from code to cloud—rather than a set of isolated controls.

Cloud security is a shared responsibility between your organization and your provider:

• Cloud provider responsibilities typically include:
  
  • Physical datacenters, hosts, and network.
  • Secure physical and software supply chain.
  • Baseline platform security capabilities (for example, DDoS protection, encryption options, identity and access features).
• Your organization’s responsibilities typically include:
  
  • Identity and directory infrastructure.
  • Information and data protection (classification, access policies, encryption choices).
  • Devices (mobile and PCs), applications, accounts and identifiers, operating systems, and network controls you configure.
• Shared responsibilities involve how you configure and use the provider’s capabilities—turning on features, setting policies, and maintaining secure operations.

To assess whether a cloud platform is ready for AI-era threats, the text suggests asking questions such as:

• Security focus and investment: How focused are you on security when developing the platform? What level of security investment and headcount do you have?
• Infrastructure and supply chain: How do you secure your data centers? How is your physical and software supply chain secured?
• Built-in security features: What security features are built into the platform? Are any security features only available through third parties?
• Guidance and transparency: What guidance do you provide to help us take the right security steps? How transparent are you when security incidents occur?

Using Azure as an example, the platform is designed to help organizations rethink security end to end with:

• Multiple layers of protection—from chip-level safeguards to network and identity controls.
• Automated threat detection, always-on data encryption, and a zero-trust architecture.
• Large-scale security engineering efforts, such as the Microsoft Secure Future Initiative, which has mobilized the equivalent of 34,000 full-time engineers to raise security standards.
• Proven DDoS mitigation, with Azure DDoS Protection handling a peak of about 3,500 attacks daily in late 2023.

When you combine this kind of platform capability with your own governance, configuration, and operational discipline, you can reshape your cloud security posture for both current and emerging AI workloads.