CISOs warned cloud supply-chain attacks set to surge

CISOs are being urged to shift attention from standalone threats and AI hype towards systemic cloud risk, as security leaders forecast a sharp rise in attacks on major cloud platforms and their supply chains through 2026.

Robert Rea, Chief Technology Officer at security analytics firm Graylog, said organisations face a period of escalating exposure as convenience-led cloud adoption collides with increasingly automated and aggressive cyberattacks.

Rea said artificial intelligence will shape the threat landscape. He argued that the larger and more immediate danger lies in how organisations build and use cloud services.

"As we head into 2026, it's tempting to view artificial intelligence as the defining force in cybersecurity. AI will certainly be influential, but in my view, it risks overshadowing a more immediate and dangerous reality: the profound security implications of the global rush to the cloud," said Robert Rea, Chief Technology Officer (CTO), Graylog.

Cloud infrastructure now underpins core business processes across sectors from finance and retail to healthcare and manufacturing. Security teams increasingly rely on shared platforms, third-party software and machine-to-machine connections that span many providers and regions.

Rea said this model concentrates risk as well as data.

"Cloud adoption has created vast, target-rich environments. Rather than attacking individual organisations, adversaries are increasingly incentivised to compromise cloud providers and shared services that act as gateways to hundreds or even thousands of downstream victims. The scale, interconnectedness, and speed of modern cloud ecosystems mean that a single weakness can cascade rapidly across industries and borders," said Rea.

Supply-chain focus

Security specialists have highlighted third-party and supply-chain exposure for several years. Rea expects that pressure to increase as companies deepen reliance on cloud-native services and automation.

He said more organisations now plug in new cloud tools and data services with limited visibility into the trust relationships that sit behind them. He also said many security teams struggle to map which external systems can access sensitive data or control critical processes through APIs and service accounts.

"Over the next one to three years, we should expect a marked increase in attacks aimed at major cloud platforms and their supply chains. Organisations are embedding new cloud services into their operations faster than ever before, often without fully understanding the authentication, authorisation, and trust relationships they introduce. APIs, machine-to-machine communications, and emerging control layers will become prime attack vectors, offering adversaries efficient ways to move laterally and at scale. In many ways, the convenience that made cloud so attractive has also made it inherently more fragile," said Rea.

AI-driven escalation

At the same time, attackers are adopting AI and machine learning to refine targeting and automate intrusion steps. Security leaders expect more frequent and more varied intrusion attempts, including phishing campaigns and credential attacks that adapt rapidly in response to defensive measures.

Rea said AI will sit on top of existing weaknesses in cloud design and operations. He warned that this will increase the pace at which attackers probe shared infrastructure and exploit configuration errors, token theft and mismanaged identities.

"Overlay this with the acceleration provided by AI and machine learning, and the challenge intensifies. AI will dramatically increase the speed, volume, and variability of attacks. While defenders must build systems that work reliably every time, attackers only need to succeed once - and AI tilts that balance further in their favour," said Rea.

Defensive gap

Many organisations still struggle with basic controls such as patching, multi-factor authentication, and monitoring of critical logs. Ransomware incidents and commodity malware remain common, particularly among mid-sized businesses and public sector bodies with constrained budgets and staff shortages.

Rea said this gap leaves security teams on the back foot as the threat environment shifts toward large-scale, cloud-centric operations and AI-enabled adversaries.

"Too many organisations are still fighting yesterday's battles, struggling with basic cyber hygiene and commodity ransomware. My advice is straightforward: stop building security for today's drizzle and start preparing for tomorrow's storm. Security leaders need to design capabilities that can withstand not just more attacks, but faster, more automated, and more relentless ones. The uncomfortable truth is that things will get worse before they get better - but those who prepare now will be far better positioned to weather what's coming," said Rea.