Report by ARMO

The State of Cloud Runtime Security

13 FINDINGSPublished Jun 4, 2025
View Original Report →

Key Findings

Security teams receive an average of 4,080 alerts per month from multiple cloud security tools.

CloudToolsAlertsAlert fatigue

It takes an average of 7.7 days, up to 30 days, to correlate alerts across cloud tools and organizational silos.

CloudToolsAlertsAlert fatigue

63% of organizations deploy more than five cloud runtime security tools.

CloudTools

46% of respondents grapple with cloud security tool alert fatigue.

CloudToolsAlertsAlert fatigue

Security teams must sift through roughly 7,000 cloud security tool alerts to find a single active threat.

CloudToolsAlertsAlert fatigue

45% of respondents report consistent false positives from their cloud security tools.

CloudToolsAlertsAlert fatigueFalse positives

92% of respondents believe that unified cloud runtime security solutions would enhance incident response efficiency and contextualise alerts.

CloudToolsAlertsIncident response

Organizations experience only 7 true cloud security events per year.

CloudTools

89% of respondents report that their current processes fail to detect active cloud threats.

CloudTools

A striking 38% of SecOps professionals identify the Cloud Security team as their most difficult collaboration partner during incidents.

Cloud

The Platform team is identified as the most difficult collaboration partner by 31% of SecOps professionals.

Cloud

Establishing separate cloud security teams is a practice adopted by 63% of companies.

CloudStaffTalent

Only 13% of organizations successfully correlate alerts between cloud security tools.

CloudToolsAlertsAlert fatigue