PETALING JAYA: Tenable, the exposure management company, revealed in its 2025 Cloud Security Risk Report released yesterday that cloud workloads supporting artificial intelligence (AI) initiatives are more vulnerable than traditional workloads.
The report found that 70% of AI workloads across AWS, Azure and GCP contain at least one unremediated critical vulnerability, posing increased security risks for organisations in Singapore and Southeast Asia as AI adoption accelerates.
AI workloads, with their vast training datasets and model development processes, are an increasingly attractive target for threat actors. The study found that 77% of organisations using Google’s Vertex AI Workbench had at least one notebook instance configured with an overprivileged default service account, which could allow privilege escalation and lateral movement across cloud environments.
These risks are increasingly top-of-mind for regulators across Southeast Asia. In Singapore, the Cybersecurity Act and Monetary Authority of Singapore’s (MAS) Technology Risk Management Guidelines mandate stringent cloud and AI security controls. Indonesia’s PP 71 and Otoritas Jasa Keuangan (OJK) regulations require secure cloud usage and local data storage for financial institutions, while Malaysia’s Risk Management in Technology (RMiT) framework sets out strict cloud risk practices for banks. Thailand’s Personal Data Protection Act (PDPA) and Bank of Thailand (BOT) guidelines emphasise access controls and transparency, and the Philippines’ Data Privacy Act and Bangko Sentral ng Pilipinas (BSP) regulations call for data classification, strong authentication and robust third-party governance.
As these regulatory frameworks evolve, organisations must embed security early into AI development to ensure compliance and mitigate emerging cloud risks.
Tenable’s research also shows broader progress in cloud risk management. Toxic cloud trilogies, workloads that are publicly exposed, critically vulnerable, and highly privileged, fell to 29% of organisations surveyed, a nine-point improvement from 2024. Tenable’s researchers attribute the nine-point decline to sharper risk-prioritisation practices and wider use of cloud-native security tooling, yet warn that even a single trilogy provides attackers with a fast lane to sensitive data.
Identity remains the foundation of a secure cloud environment. The report finds that 83% of AWS users have configured at least one identity provider (IdP), a best practice for securing human and service identities. Yet, the presence of identity-based risks persists. Credential abuse remains the most common initial access vector, implicated in 22% of breaches, underscoring that strong multi-factor authentication (MFA) enforcement and least privilege principles are critical to meet regulatory expectations and protect sensitive data.
“Organisations have made real strides in tackling toxic cloud risks, but the growing adoption of AI workloads is introducing a fresh layer of complexity,” said Ari Eitan, director of Cloud Security Research at Tenable.
