Security policy misconfigurations are emerging as a significant operational risk for organisations running hybrid and multi-cloud environments.
Nearly two-thirds of surveyed companies report a business-critical application suffered an outage because of a policy error in the past year.
According to a survey by the Cloud Security Alliance (CSA), 65% of organisations experienced at least one business-critical application outage linked to a misconfigured security policy over the past 12 months, while 46% experienced two or more such outages.
Based on a May 2026 survey of 515 IT and security professionals, the report examines how fragmented ownership, limited visibility and manual security policy management create measurable costs in production uptime, deployment velocity and compliance readiness.
The findings highlight the growing difficulty organisations face in managing security policies, as business applications increasingly span public cloud, private cloud and on-premises infrastructure.
The CSA says the problem is being compounded by continued reliance on manual policy management. Nearly half of surveyed organisations – 48% – describe their security policy changes as mostly or fully manual, compared with only 22% that have mostly or fully automated processes.
Manual configuration errors were identified as one of the biggest bottlenecks to deploying new applications, alongside cross-team coordination and obtaining security policy approvals.
The consequences extend beyond application outages, says the CSA. The survey found that policy misconfigurations or gaps were associated with delayed application deployments at 40% of organisations, near-miss security incidents at 34%, unplanned rollbacks or emergency changes at 31%, failed compliance audits or audit findings at 25%, and actual security incidents or breaches at 18%.
The findings show that security policy management is increasingly becoming a production reliability issue rather than simply an IT hygiene concern.
The CSA survey found that only 48% of organisations can remediate a production policy issue within three days. Of these, 23% can resolve issues in less than 24 hours and 25% within one to three days.
For 38% of organisations, remediation takes four days or longer, while 14% cannot reliably estimate how long remediation takes.
Fragmented responsibility
The problem is further complicated by the way responsibility for application connectivity policies is distributed across organisations.
Security operations teams are involved in defining such policies at 51% of organisations, followed by network operations and cloud architects at 46% each, and DevOps or application owners at 41%. Chief information security officer and security leadership is involved at 35%, while governance, risk and compliance teams are involved at 23%.
Therefore, no single function has sole ownership of connectivity policy.
This fragmentation is mirrored in the number of tools teams use. Some 67% of organisations use three or more security management consoles daily to manage connectivity, while 16% use six or more.
At the same time, 92% of respondents report at least some difficulty obtaining a single, accurate view of security policies across their environments. Only 7% say they have no difficulty doing so.
The CSA says this creates a structural visibility problem, with different teams making decisions based on partial views of an organisation's security policy environment.
Business-critical applications are most commonly spread across multi-cloud environments, cited by 53% of respondents, followed by on-premises data centres at 50%, private cloud at 46%, hybrid environments at 36% and single-provider public cloud at 29%.
Compliance pressure
The survey also highlights a gap between organisations' compliance ambitions and the way compliance is managed.
Manual review remains the most common approach, with 40% of respondents saying compliance is maintained primarily through manual processes and reviews. Only 9% say security policy management is fully integrated into development and deployment workflows.
At the same time, one in four organisations reported a failed compliance audit or audit finding related to policy gaps in the past year.
The CSA cautions that the survey does not establish that organisations relying on manual compliance are necessarily the same companies reporting audit failures. However, it argues that manual, periodic reviews may no longer be sufficient for environments where policies and applications change continuously.
The challenge is particularly relevant as regulatory requirements increasingly emphasise continuous compliance and operational resilience.
AI and automation
Organisations are looking for technology that can help them move from reactive policy management towards prevention.
The most requested capability over the next 12 months is risk or impact analysis before a policy change is committed, selected by 32% of respondents.
That was twice the rate of any other capability. AI-assisted anomaly detection, automated policy provisioning and continuous compliance auditing were each selected by 16% of respondents.
However, the CSA notes that effective pre-change risk analysis depends on having a unified and accurate view of the existing policy environment – precisely the capability most organisations currently lack.
The survey therefore points to a broader maturity problem.
Some 40% of organisations remain at what the CSA characterises as the manual stage, where compliance is primarily maintained through manual processes and reviews. A further 21% are reactive, addressing policy issues after they are identified.
Only 30% are classified as proactive, using automated tools to detect potential risks before incidents occur, while just 9% have fully integrated security policy management into development and deployment workflows.
This means 61% of organisations remain in manual or reactive stages of policy management.
Budgets constrain transformation
The survey suggests organisations will have to address these shortcomings without significant increases in security spending.
Only 44% expect their security budgets to increase in 2026, while just 7% anticipate an increase of more than 20%. Thirty-nine percent expect budgets to remain unchanged, while 37% expect increases of between 1% and 20%.
The CSA concludes that organisations need to rethink how security policy is managed across hybrid and multi-cloud environments rather than simply adding more tools.
It identifies four capabilities as the foundation of a more mature approach: unified visibility across environments, pre-change risk analysis, automation of routine policy management, and continuous compliance.
The survey argues that these capabilities should form part of an operational redesign that consolidates visibility, clarifies ownership and embeds security policy into application development and deployment workflows.
For organisations increasingly dependent on applications distributed across multiple clouds and infrastructure environments, the findings suggest the security challenge is no longer simply protecting individual systems.
Instead, it is ensuring security policies governing how applications communicate can keep pace with the speed and complexity of the environments in which those applications operate.
Share
