A survey published this month suggests that few organisations detect cloud security incidents within the first hour, and that many take more than a day to remediate them. The time between an attacker gaining access and the organisation responding shapes how far an attack can spread and how much harm it can cause. Boards of organisations that run important services in the cloud can ask management how quickly it would know about an incident and what evidence supports that answer.
What the survey reports
Check Point's 2025 Cloud Security Report, based on a survey of 937 security professionals conducted by Cybersecurity Insiders in early 2025, found that 65% of respondents' organisations had experienced a cloud-related security incident in the previous year. Only 9% said they had detected an incident within the first hour, and 6% had remediated one within the first hour. Sixty-two per cent said remediation took more than 24 hours.
The report comes from a security vendor and reflects what respondents said about their own organisations, so its figures are best read as an indication of the problem. They are consistent with a broader point that boards can test directly, which is whether their own organisation measures how long detection and response take.
Why detection time matters to the business
Once inside a cloud environment, an attacker can use the access gained to reach other systems and acquire greater privileges. The survey found that only 17% of respondents had full visibility of traffic moving between systems inside their cloud environments, which is the route that kind of movement takes. The longer an intrusion goes unnoticed, the more systems and data it can reach, and the longer and more costly recovery can become.
Detection also starts several regulatory clocks. Under NIS2, an essential or important entity must submit an early warning to the relevant CSIRT or competent authority "without undue delay and in any event within 24 hours of becoming aware" of a significant incident. Under UK GDPR, a personal data breach must be reported to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Under DORA, a financial entity must submit an initial notification of a major ICT-related incident within four hours of classifying it as major, and no later than 24 hours after becoming aware of it.
These deadlines run from awareness. An organisation that detects an incident late has already lost time to contain it, and it may then have to make a regulatory notification with limited facts about how the attacker got in and what was affected.
Where responsibility sits in the cloud
Cloud providers secure the underlying infrastructure. The customer remains responsible for how it configures its services, who has access to them, what it logs and how it monitors that activity. The NCSC's Cloud Security Principles set out this division and the information a customer needs from its provider to investigate incidents.
For the board, the practical consequence is that detection in the cloud depends on decisions the organisation makes. These include which activity is logged, how long logs are kept, which events raise an alert and who responds to it. Where an organisation uses several cloud providers, or combines cloud and on-premises systems, those decisions need to be consistent across each environment for the organisation to see an attack that crosses between them.
What can slow detection
The survey points to several factors. Forty per cent of respondents cited fragmented tools that do not integrate well, and 71% reported using more than ten cloud security tools. More than half said they face close to 500 alerts a day. Forty-nine per cent cited a shortage of skilled staff.
Each of these can delay a response. Where alerts arrive in large volumes from separate tools, analysts can miss the few that matter or take longer to connect related events. Where the team responsible for monitoring is small, alerts outside working hours may wait until the next day. Automated detection and response can reduce the time spent on routine alerts, provided the rules behind it are maintained and tested against the organisation's own environment.
What leadership should require
The board should expect management to set targets for how quickly incidents affecting important services are detected and contained, and to report performance against them. Targets can reflect the business impact of each service and the regulatory deadlines that apply.
Management should also be able to show that logging and monitoring cover each cloud environment the organisation uses, with clear ownership for responding to alerts at all hours. Where monitoring is provided by a third party, the contract and service levels need to support those targets.
Detection and response capabilities need regular testing. Exercises that simulate a cloud intrusion can show how long it takes to notice the activity, who is told, and whether the information needed for a regulatory notification would be available in time.
Questions for the board
- How quickly would we expect to detect a serious incident in our cloud environments, and what evidence supports that estimate?
- Which of our important services run in the cloud, and what detection and containment targets apply to each?
- Do our logging and monitoring cover every cloud provider and environment we use, including those managed by third parties?
- Who responds to a high-priority alert outside working hours, and how do we know that works?
- How many security alerts do we receive, and how do we make sure the important ones are acted on?
- Could we meet the incident notification deadlines that apply to us with the information we would have at that point?
- When did we last exercise our response to a cloud intrusion, and what did we change as a result?
A Cloud Security Governance Review establishes whether cloud security governance operates in practice, including ownership, policies and control monitoring, and sets out what needs fixing first.
References
- Check Point Software Technologies and Cybersecurity Insiders, "2025 Cloud Security Report", 5 June 2025.
- European Parliament and Council, Directive (EU) 2022/2555 (NIS2), 14 December 2022.
- European Parliament and Council, Regulation (EU) 2022/2554 (Digital Operational Resilience Act), 14 December 2022.
- European Commission, Delegated Regulation (EU) 2025/301 on the content and time limits for reporting major ICT-related incidents.
- Austrian Financial Market Authority, "DORA: ICT-related incidents".
- UK GDPR and Information Commissioner's Office, "Personal data breaches: a guide".
- National Cyber Security Centre, "Cloud security guidance: the cloud security principles".