Source: Datadog
The median number of high or critical severity vulnerabilities in cloud services analysed by Datadog rose fourfold, from four in February 2026 to around 16 in November, according to the company’s new State of Cloud Security 2026 report. Datadog calls this the “vulnpocalypse”, and its point is that the growth in the CVE database is not a theoretical risk: real applications running in real cloud environments are carrying more serious known flaws than they were a year ago.
AI keys quietly widen the blast radius
The report argues that when flaws multiply, the decisive question is how far an attacker can get from one compromised application. One answer sits in AI credentials. More than one in five organisations analysed uses cloud AI services, which are typically accessed with long-lived API keys that stay valid until revoked. Datadog found that nearly half of organisations using Google Gemini rely on long-lived Gemini API keys, and 17 per cent of Amazon Bedrock users rely on long-lived Bedrock keys. Attackers are already adapting: Datadog Security Labs uncovered tools that test whether stolen AWS credentials can access Amazon Bedrock, and observed similar probing in 12 organisations’ cloud environments over a 30-day period. As Datadog’s Andrew Krug puts it, attackers do not need their own AI model if they can steal the key used to reach yours.
Supply chain reach and perimeter progress
Cloud workloads in the analysis depend on 149 software packages on average, more than half of them indirect dependencies, and 60 per cent of organisations run applications using a package version released less than 24 hours earlier, which shows how quickly a compromised release could land in production. The Shai-Hulud 2.0 malware demonstrated the consequences by searching infected systems for cloud credentials. There is progress too: 55 per cent of AWS organisations analysed have adopted data perimeters, up from 40 per cent in 2025, which limits what a stolen credential can actually reach.
The engineering takeaway
For DevOps and platform teams the report reads as a checklist: replace static AI and cloud keys with temporary credentials, enforce dependency review so a fresh package version is not automatically trusted, keep an inventory of what every credential can access, and adopt data perimeters so one compromised service does not become a system-wide incident. Remediation pace also matters, because the report shows the vulnerability backlog per workload is growing faster than most teams are burning it down.
If you want help auditing your cloud security posture, cutting long-lived credentials out of your platform or building data perimeters on AWS, contact Excello Digital for advice from a team that builds and secures cloud infrastructure for a living.