Escaping the Silent Crisis

The transition from exclusively on-premises business IT to hybrid on-premises/cloud environments is among the most important events in the history of business computing.

It has increased scalability, flexibility, and innovation opportunities. Often it has become essential for corporate workflows and inter-corporate collaborations. No wonder 90% of IT leaders say they are managing distributed hybrid environments.

But as the following data from Rubrik telemetry and Wakefield Research shows, hybrid environments have also created unprecedented hazards:

IT leaders report challenges in securing data systemwide, say they lack visibility, and can't establish centralized control. Malicious actors know this, and they are exploiting hybrid cloud systems relentlessly. Attacks are coming over at least 10 vectors, far more than in the past.

Ninety percent of survey respondents say they've been attacked. Almost one-fifth say they're getting attacked every other week. And those are the ones they know about. Bad actors are changing their techniques, from malware to social engineering and identity-based strategies. Identity attacks may now account for three-quarters of all attacks.

The reason? It works. Successful attacks are on the rise, and time from entry to command and control of sensitive data is dropping fast.

As a result 86% of companies surveyed report paying a ransom when facing extortion demands. Nearly three-quarters say attackers were able to access and harm their data.

These hazards are becoming a crisis and no one is talking about it. Probably because few have a good plan. Instead, they slowly move to the cloud, say they’re counting on cloud providers to fix the issue, or simply ignore it and call it a cost of business.

It doesn’t have to be like this. Companies must get ahead of threat actors by thinking like them: Threat actors want to find and control the most valuable data, so they can stop operations. If they can do it, companies can too.

Rubrik Zero Labs is committed to providing practical, unbiased intelligence aimed at helping organizations reduce their data  security risk. In pursuit of this goal, we have included information from three main sources.

Rubrik Telemetry

We employed Rubrik telemetry to gain insights into the typical organization’s data environment and associated risks. It’s based on two sources:

1. Backup Data is cloud, SaaS, and on-premises  data that we’ve backed up from customer environments.
2. Production Data is cloud, SaaS, and production data that Rubrik actively monitors, so organizations can make decisions about how they manage risk in their environments.

Contributing Organizations

In order to provide a more well-rounded and impartial point of view, Rubrik has also incorporated crucial information from diverse organizations offering distinct perspectives. 

Locating and securing data has been a challenge since the first networked computer. However in the past decades, as companies have moved to cloud computing for more of their IT operations, the dimensions of the challenge have multiplied like never before.

Before, data was in the corporate data center or on people's computers, initially on desks and then on desks and laptops, connected to a single network. Today, data sprawls across many types of devices, relying on many networks to access the corporate jewels, now residing on premises and in the cloud.

Over the last couple of decades, business has demanded the benefits that come with using cloud and SaaS services. And with good reason! Most of our lives are easier with the cloud.

Organizations are continuing to increase their utilization of cloud and SaaS services and hybrid and multi-cloud strategies are becoming the norm, with 89% of organizations utilizing multiple cloud platforms, according to Allied Market Research.^[1]

In addition our survey results showed:

With every new cloud and SaaS use case, businesses lose a tiny bit of control over their data. IT and security leaders must send their data to more locations, to a point where many corporate data repositories effectively span the world. Then, they must figure out where it is and how to secure it. Figuring out how much data a company has, where it is, and how a range of third party services are securing it is an unprecedented challenge.

IT leaders see the challenge primarily across three categories:

Today’s adversaries operate with purpose, discipline, and business-like precision, constantly adapting their tradecraft to exploit modern enterprise environments.

The broader corporate shift toward cloud infrastructure, identity-driven access, and distributed workforces has forced threat actors to explore new ways to conduct and scale their operations. As threat actors evolve, they increasingly rely on techniques like valid credential abuse, hands-on-keyboard intrusions, and social engineering—often bypassing traditional malware entirely. Their methods reflect an enterprising mindset that prioritizes innovation, operational efficiency, and technical skill.

According to CrowdStrike 2025 Global Threat Report:

And finally, they also observed a dramatic decrease in the amount of time it takes for a threat actor to move from the area they initially compromised to other systems (aka breakout time). “In 2024, the average breakout time for interactive eCrime intrusions fell to 48 minutes, down from 62 minutes in 2023.

These stats are alarming for any organization with data in cloud or SaaS environments.

Everyone's data is a potential target.

And with the growth in identity-based attacks, opponents are logging in, not breaking in, something that is a lot harder to detect and stop in any environment. That initial foothold also makes it much easier to move quickly across IT systems.

Here’s what IT and security leaders said about how these circumstances are affecting them on the front lines:

Coming From All Directions

IT and security leaders said that the types of cyberattacks they were experiencing are coming from all directions.

Here’s what IT and security leaders said about how these circumstances are affecting them on the front lines.

However, it’s worth noting that as a whole, their experience ran the gamut from increased security measures and costs to unrecoverable data loss.

Given all this new complexity, and the new threats that have arisen in response to it, how can IT and security leaders feel confident in their data security solutions?

Many businesses also harbor misconceptions about the inherent security of cloud services, assuming that cloud providers will take full responsibility for safeguarding their data. This reliance can lead to a false sense of security, leaving organizations vulnerable to risks, such as data breaches or loss, particularly if something catastrophic occurs.

While cloud adoption has become a cornerstone of modern business practices, some organizations remain hesitant to fully embrace the shift. Challenges, such as understanding application dependencies, comparing on-premises and cloud costs, and assessing technical feasibility, often serve as significant barriers.

A Zero Trust Security Model

In contrast, other organizations are turning to a Zero Trust security model, which assumes no user or device can be inherently trusted, regardless of location.

While this approach can bolster security, it is laborintensive and requires meticulous planning, including the assessment of every device, application, and user within the organization. The rigorous nature of Zero Trust demands a significant cultural and operational shift, which can drive up costs, increase complexity, and disrupt workflows. This makes it difficult to implement without slowing business velocity, presenting a trade-off between security and operational efficiency.

There’s another way. Managing hybrid, globally dispersed data begins with an awareness of where things are. Sensitive data should be located and classified, so companies can identify and protect potentially sensitive targets as early as possible.

For example, through our Rubrik telemetry of production data, we can estimate that organizations typically store sensitive structured data sits in these environments:

And that its biggest caches of sensitive unstructured data are estimated to sit in these environments:

Securing Your Sensitive Data

As an IT and security leader, even with this amount of information, you can start to make some decisions. Ultimately, you care about all your data, but the stuff you really care about is your sensitive data.

Knowing how much of it you have and where it lives is your first step to  better securing it.

From there, you can start to break down just how sensitive your cloud and  SaaS data is. Here are some examples to get you started.

And you can start to pinpoint just where that highly sensitive data is.

Then, you can start to draw a clearer picture of what sensitive data might include:

This exercise is the first step in reasserting knowledge and control. It’s also a great way to get board-level support for your security strategy. The high-level message changes from “We have sensitive data spread across several unknown points, with varying security” to:

Establish Clear and Comprehensive Policies

After increasing awareness of data location and data type across the hybrid system, it’s important to establish clear and comprehensive policies. Unfortunately, at present many companies have a haphazard approach.

Comparing the data that we monitor in production environments to the data that we back up, we have seen the huge disparity between how organizations protect on-premises data and how they protect their cloud and SaaS data.

How organizations handle data backups is particularly stark. On-premises data is routinely backed up with strict retention policies, air-gapped copies, and disaster recovery plans that have been refined over years.

Cloud and SaaS data, in the meantime, is often backed up haphazardly, if at all.  The implications for a cloud-centered ransomware attack are sobering.

This information leads us to believe that organizations are relying on their cloud providers’ native backup tools to secure their data. Unfortunately, native backup tools are often limited, infrequent, or tied to the provider’s infrastructure in ways that may not align with an organization’s recovery needs. Even assuming state of the art performance at every cloud and SaaS provider, surrendering your awareness and control is a problematic security approach.

No sensible risk management approach assumes everything is state of the art. The fact is, critical business data stored in cloud applications and SaaS platforms is more vulnerable to accidental deletion, ransomware attacks, and policy misconfigurations than its on-premises counterpart.

Controlling your backup capability, off prem as well as on, is a crucial part of controlling  corporate security.

This is beyond a technical problem. It’s a strategic blind spot. The question IT and security leaders should ask themselves:

Let’s refer to a real world example with the Gitlab database incident of January 31, 2017.

Addressing the problem requires action: a unified approach to data protection that extends backup and recovery policies beyond on-premises systems into the cloud-native world.

Here’s how IT and security leaders can increase their capabilities and confidence in their ability to protect their data across cloud, SaaS, and on-premise environments. 

01 First, know where your data, particularly your sensitive data, is, at motion and at rest.

Prioritization matters, since everyone has scarce resources. Don’t secure a folder of five-year-old marketing videos with the same intensity required for an organization’s most precious intellectual property.

Keep in mind this might be a bigger undertaking than it sounds. Like all data, sensitive data can change over time. For instance, an idea could go from a single employee’s random musing to one of the main building blocks of an organization’s strategy in a matter of weeks. Still, you need to know where it all is and protect  it accordingly.

02 Inform your policies, processes, and procedures with data awareness and data prioritization.

Inform your policies, processes, and procedures with data awareness and data prioritization.

Policies

Set appropriate policies. For instance, control the conditions under which sensitive files are downloaded. For example, maybe it’s a policy to restrict editing access to your organization’s source code on a public WiFi network if you aren’t using a VPN. These may seem like obvious ideas, but you’d be surprised how often people forget to employ them in a systemic way.

Processes and Procedures

Define methods for enforcing policies. For instance, if users aren’t allowed to download specific files under specific circumstances, then:

• How are you going to enforce that policy? 
• How are you going to track when it’s violated? 
• How are you going to deal with the fallout of that violation? 
• Who is responsible for making sure that happens?

Companies must answer all these questions to ensure data safety and to give boards and leadership confidence that you know where all your sensitive data is and you have a plan for protecting it.

03 Use automation to help your security and IT teams level the playing field.

There’s no way anyone can expect security and IT teams to keep up with what’s happening with the vast amount of data an organization generates without some significant help. Even with monitoring and aggregation tools, the amount of alerts coming at often short-staffed teams is enough to make even the most talented and hardened IT and security professionals want to bury their heads in the sand.

The only way to effectively ensure that policies are enforced and processes and procedures are followed is through automation.

For example, when a security incident occurs, a root-cause analysis is necessary. Without automation, security analysts must manually sift through large volumes of data—a tedious and time-consuming process. As we know, repetitive tasks increase the likelihood of human error. A common example is an analyst in the SOC mistakenly marking a true positive as a false positive, potentially leaving a threat unaddressed.

By automating routine and repetitive tasks, organizations not only reduce errors but also free up skilled professionals to focus on more strategic and high-value security efforts.

Conclusion

The transition to multi-cloud hybrid environments marks one of the most significant milestones in the history of business computing.

It has become essential for corporate workflows and inter-corporate collaboration. Yet, as this analysis has shown, these benefits come at a high cost in terms of security risks. Hybrid environments introduce unprecedented hazards: IT leaders report challenges with system-wide data security, lack of visibility, and the inability to establish centralized control. Threat actors are exploiting these weaknesses relentlessly and employing evolving techniques like identity-based strategies, which now account for the majority of attacks. The results are alarming: