Sysdig has published the Sysdig 2026 Cloud-Native Security and Usage Report, which states that organizations have reached the limits of human-driven security operations and are increasingly relying on machine-speed detection and response to defend their cloud environments. Based on an analysis of billions of software packages across hundreds of thousands of cloud identities, Sysdig’s 2026 report highlights how defenders are evolving their strategy as attackers weaponise AI to exploit vulnerabilities within hours of disclosure. The findings show that organizations are turning to runtime security, automation, and AI-enabled protection to keep pace with the speed and scale of modern threats.
Security teams have optimised human workflows, but they’ve reached their limit. AI-assisted threats move too fast for dashboards, alerts, and manual triage. The human-driven era of cloud security is coming to an end, and the rise of AI autonomy will define the next generation of cyber defence.
Loris Degioanni, Founder and CTO of Sysdig
The report describes four key trends:
- AI adoption is accelerating and laying the foundation for machine-driven security. AI-specific packages grew 25 times year over year and enterprises are building a secure development foundation by using six times more machine learning packages. Furthermore, despite growing AI adoption, only 1.5% of these assets are publicly exposed, indicating a deliberate approach to securing emerging AI workloads.
- Despite global concerns that AI regulation and data sovereignty would slow innovation, they have had the opposite effect. European organizations are deploying more than 50% of all AI and machine learning packages, and account for more than 34% of the adoption of Falco, the open source standard for runtime threat detection in containers and Kubernetes. This data suggests that regulatory frameworks are driving disciplined adoption and stronger security practices instead of limiting experimentation and expanding the attack surface, while showing a clear regional emphasis on data sovereignty and secure cloud operations.
- Defenders are turning to automation to stay ahead of AI-powered attackers. More than 70% of security teams now use behaviour-based detections, protecting 91% of cloud environments with high-fidelity runtime alerts. At the same time, 140% more organizations year over year now automatically terminate suspicious processes when a detection triggers, signalling a significant shift toward machine-speed response (1).
- Automation and machine-driven operations, especially as AI coding agents gain widespread popularity, are redefining the boundaries of cloud security. Human users now account for just 2.8% of managed identities within cloud environments. This growing chasm highlights the scale and urgency associated with securing machine identities.
Resilience Forward comment
(1) The 140% increase in automated termination of processes presents a significant and potentially unexpected consequential resilience risk to availability. Without human-in-the-loop oversight, aggressive automated responses could trigger widespread business as usual disruptions and cascading system failures.
