Summary
- Datadog's monitored cloud workloads had a median of four high- or critical-severity third-party library vulnerabilities in February, rising to 16 in November.
- Nearly half of organisations using Google Gemini rely on long-lived API keys, while persistent credentials remain common across other cloud services.
- The study identifies rapid adoption of software dependencies and increasing AWS data-perimeter use, but its findings concern a sampled customer population.
The median number of high- or critical-severity vulnerabilities identified in monitored cloud workloads increased fourfold over nine months, according to new research from Datadog, as enterprises contend with growing software exposure and persistent weaknesses in credential management.
Its State of Cloud Security 2026 report found that the median number of serious vulnerabilities affecting an analysed cloud workload rose from four in February to approximately 16 in November.
The results draw on security information from thousands of organisations using Amazon Web Services, Microsoft Azure and Google Cloud. The vulnerability analysis specifically examines open high- and critical-severity weaknesses in third-party software libraries associated with applications monitored by Datadog’s software composition analysis technology.
The findings therefore describe an observed change within the company’s monitored sample. They are not a census of every cloud application, nor do the figures establish that successful attacks increased at the same rate.
Datadog associates the sharp rise with advances in AI-assisted vulnerability discovery, which have increased the volume of weaknesses being reported and documented. The study identifies an acceleration after May, but its fourfold comparison covers February to November.
AI services bring familiar credential weaknesses
The research also finds that more than one in five organisations analysed use cloud-hosted AI inference services. Although these platforms can be accessed through temporary cloud identities, long-lived API keys remain common.
Nearly half of organisations using Google’s Gemini services employ long-lived Gemini API keys, Datadog found. Among organisations using Amazon Bedrock, 17% use Bedrock API keys, while Microsoft’s Azure Foundry environment presents a different problem because long-lived credentials are generated by default for many resources.
A static key can remain valid until its owner revokes it. If the credential is exposed through application code, a compromised development environment or inadequate secret handling, an attacker may be able to continue using the associated service without possessing the original account holder’s password.
Cloud AI credentials can also carry financial exposure because access to an inference service may incur usage charges. The operational consequences depend on the permissions attached to the credential, whether spending controls exist and whether the provider can distinguish normal workloads from unauthorised requests.
Datadog’s findings show that older credential practices remain embedded alongside newer authentication methods. Although adoption of federated access and temporary workload identities is increasing, organisations continue to retain static keys for users, applications and deployment pipelines.
These weaknesses are not exclusive to AI services. The underlying problem concerns access credentials that remain usable for long periods and may carry permissions beyond an application’s immediate requirements.
Software dependencies accelerate exposure
The report found that cloud application workloads depend on 149 software packages on average. More than half are transitive dependencies introduced indirectly through other packages rather than selected explicitly by a development team.
A developer may be familiar with the principal libraries used by an application without recognising every component installed through its dependency chains.
Datadog also found that 60% of organisations in its sample run at least one software package version released less than 24 hours earlier. Across analysed cloud applications, 21% use such newly published versions.
New releases are not inherently unsafe, and rapid updating can be essential when vulnerabilities are corrected. However, compromised software distributed through a legitimate package repository may reach dependent applications before investigators identify and remove the malicious release.
Recent software supply chain attacks have demonstrated how malicious packages can search for cloud credentials and use access granted to development environments or deployment pipelines. The risk depends on the privileges available to the affected software, not simply the number of dependencies installed.
Datadog’s findings therefore connect vulnerability management with identity and software provenance. Correcting a vulnerable library can reduce one route into an application, while limiting credentials and permissions can restrict what happens if that application is compromised.
Data perimeter adoption continues to grow
The study found that 55% of organisations using AWS have adopted some form of data perimeter, compared with 40% in 2025. These controls can restrict access to cloud resources according to the origin of a request, the account making it or other conditions established through AWS policies.
Much of that adoption remains concentrated in resource-specific configurations, rather than policies applied consistently across an organisation’s cloud accounts.
Consequently, a legitimate credential may still provide more extensive access than intended where individual services have inconsistent restrictions. Organisation-level controls can reduce that variation, but they require careful design and management.
The report presents a mixed picture: more reported vulnerabilities and persistent static credentials coexist with improvements in some forms of identity governance and resource protection.
Datadog’s conclusions are bounded by its customer population, the services it monitors and the methodology used for each measure. Its findings establish substantial exposure within that sample, while leaving the broader relationship between AI vulnerability discovery, remediation rates and successful cloud compromise for further investigation.
