Multicloud deployments have become a necessity for many organizations. As these deployments scale, security teams need to adopt a security approach that combines in-depth visibility, automation, adaptability, and cloud-specific threat intelligence.
Introduction
“Multicloud” is a term that applies to any organization that relies on more than one cloud service provider (CSP) to conduct business or supply essential services. A multicloud deployment could involve a combination of major CSPs, such as Google, Amazon Web Services, Azure, or IBM, and other cloud providers that support various business functions and tools.
The multicloud approach has become a standard in most industries. One report found that 89% of surveyed organizations were deploying multicloud infrastructure in 2024. While this trend has benefitted the functionality, redundancy, and speed of many business operations, there is a concurrent challenge for security teams tasked with protecting these environments. SOCs must develop and implement a security strategy encompassing the entire multicloud environment and addressing the challenges and risks associated with these deployments.
What is multicloud security?
Multicloud security solutions involve monitoring endpoints, data, networks, cloud infrastructure, applications, and tools, as well as identity and privilege management, compliance guidelines, and other processes. CSPs provide significant security protections around the infrastructure they support. However, based on the shared responsibility model, cloud users must secure the data, tools, and processes they run within the cloud environments.- More than 80% of surveyed organizations use Azure and AWS cloud services. 55% use Google.
- Most organizations report an increase in the number of buckets and storage containers they use in Azure (89%), AWS (84%), and Google (74%) clouds.
- 22.4% of surveyed organizations lack the requisite expertise for using AWS and Azure clouds securely.
- 30% of organizations are actively planning to decommission on-premises Active Directory as cloud legacy support improves.
- 49% of organizations have less than half their cloud accounts covered by cloud-native application protection (CNAPP) solutions.
All statistics sourced to: “SANS 2024 Multicloud Survey”
However, multicloud security adds another dimension in the form of an overview of all cloud deployments, and how users move between them. Each CSP provides its own distinct set of security tools, all of which the SOC must understand and complement with a proactive, holistic strategy.
Given the rapidly changing nature of cloud deployments and persistent threats, multicloud security must extend beyond prevention, and will likely involve the use of several types of security tools. Organizations also need response plans that anticipate cloud defense breaches and expand their ability to monitor their environments, engage in threat hunts, and forensic investigations.
Multicloud security challenges
Multicloud deployments are complex, dynamic, and subject to rapid changes and expansion. This creates a variety of security risks and challenges that organizations’ security teams are struggling to manage, due to increased workflows, resource shortages, and a lack of analysts with cloud-specific skills. When constructing a multicloud security strategy, many SOCs will need to consider how the strategy addresses challenges such as:
- Rapidly changing cloud environments and tools. A primary benefit of cloud operations is the speed at which new instances and tools can be spun up or eliminated based on specific business needs. But keeping track of how organizations and their employees are using services and tools is difficult from a security perspective. With ephemerality being the norm rather than the exception, security teams often struggle to maintain oversight of one cloud environment, let alone multicloud deployments.
- Expanding attack surfaces. As organizations extend their cloud footprint, many assume greater risk of security breaches related to insecure connections, unsecured assets, and code errors that provide attackers with exploit opportunities. A 2024 study found the average organization with multicloud deployments had 351 attack paths that attackers could exploit to reach valuable company assets.
- Lack of visibility. Each cloud deployment is a hive of data in transit and in storage, running applications and APIs, access points, users, and connected devices. Keeping track of all these assets and processes is a difficult monitoring task; security teams must track and correlate logs from a variety of systems, which can easily create blind spots.
- Negotiating CSP security controls. Each cloud provider works off its own version of the shared responsibility model. Moreover, the providers regularly offer new services and products, which are typically subject to updates and specific conditions. Staying current with each provider’s offerings and conditions places another tax on the time and energy of security teams tasked with monitoring cloud deployments.
- Data protection. Data breaches are one of the most common, and costly, cyber breaches among organizations of all types. The multicloud environment can amplify the challenge of protecting data through a similar principle: more and varied cloud deployments creates greater potential for misconfigurations, insufficient access controls and security settings, and more complex networks in which data can be lost, captured, or ransomed by malicious actors from the outside or inside of the organization.
- Evolving cloud-specific security threats. Attackers are well aware of the prevalence of multicloud operations and have shifted their tactics to exploit potential security weaknesses. They may target user credentials and CSP trust relationships to move from one cloud environment to others. They can exploit errors in security access controls, APIs, download malicious files or modules to cloud infrastructure systems, among other attack vectors. Increasingly, attackers have found methods of obscuring their attack patterns and escalations within normal cloud traffic, which is difficult to detect without the ability to analyze multiple sources of data.
What’s more, attackers also are developing methods for evading common security tools, such as endpoint detection and response (EDR) and cloud-native application protection platforms (CNAPP) with PowerShell scripts, windows management instrumentation (WMI) tools, cloud exploitation frameworks like Pacu and other techniques that make their intrusions blend in with normal cloud traffic and workflows. A recent CISA advisory about over-reliance on EDR tools emphasized this reality.
How organizations can improve multicloud security
Multicloud security requires a multi-faceted approach that involves effective policies, documentation, unified management, effective network architecture, identity and access management, and preventative controls such as next generation firewalls, antivirus, and intrusion prevention systems. Security, however, is still bound by the fundamental reality: “You can’t protect what you can’t see.” One of the most critical aspects of multicloud security is visualizing the environment in such a way that does not leave SOCs buried in data or moving constantly between dashboards and tools.
To expand visibility into cloud environments, enrich monitoring and detection capabilities, and deepen cloud defenses, SOCs can pursue a number of interrelated objectives:
- Monitor more than cloud flow logs. While useful for determining the overall performance and status of cloud networks, flow logs are not, primarily, used for security monitoring, and are often too shallow for security teams who need to dig deeper into network behaviors. VPC flow logs for example can only detect known command and control (C2) server communications. SOCs must also review data from cloud control planes and other systems to quickly determine when and what hosts are communicating and investigate unusual activity. Additionally, CSP-offered tools, while useful, do not always analyze data beyond what VPC flow logs contain, which can lead to significant visibility gaps.
- Automate processes. Multicloud environments scale too quickly and broadly for security teams to monitor them without automating many tasks. As one example, correlating logs and other tasks that help deepen visibility into cloud environments is time-consuming and impractical for many SOCs without assistance from automation.
- Tool consolidation. A 2024 study found the average organization is using 16 cloud security tools and 14 security tool vendors; 98% wanted to reduce these numbers. Keeping up with complex and rapidly scaling multicloud environments requires a more comprehensive security approach, which can be enabled by investing in tools that consolidate capabilities and workflows and help SOC analysts to gain unified visibility of their clouds and the connection points between them.
- Accessing cloud-specific threat intelligence. Cloud-based attacks often rely on tactics, techniques, and procedures (TTPs) that are distinct from methods that target traditional IT deployments. Multicloud security depends on access to intelligence and evidence focused on cloud-based threats and the distinct challenges that come from protecting complex multicloud environments.
- Creating cloud-specific threat detections. Security teams must deploy detections and alerts that are regularly tuned to focus on attacks common to multicloud deployments, such as data exfiltration, service enumeration, previously unknown C2 traffic and living off the land TTPs.
Network detection and response can improve multicloud security
Visualizing what happens at the network level is as critical to multicloud security as it is to traditional IT deployments. Cloud security solutions that help SOCs monitor traffic within each cloud deployment in real time can provide a significant assist, especially when they can help reduce the complexity of the security stack and create a more holistic view of the threat landscape.
Network Detection and Response (NDR) has emerged as a viable component to native cloud solutions. While many NDR platforms pre-date the cloud’s exponential growth in the private and public sectors, vendors have built out capabilities that are applicable as well as specific to cloud use cases. Leading solutions are also designed to complement and integrate with cloud-specific security tools such as Workload Protection Platform (CWPP), Cloud Security Posture Management Cloud (CSPM), Cloud-Native Application Protection Platform (CNAPP), as well as identity and access management and privilege management solutions and data management tools.
Advanced NDR solutions can deliver the in-depth visibility into cloud networks, as well as the control and data planes, containers, serverless environments, and other aspects of dynamic, often ephemeral multicloud environments. Through use of packet mirroring, packet brokers, and traffic cloning, they can deliver comprehensive, enriched telemetry that creates a "ground truth" about how hosts and users are operating within cloud environments that goes much deeper than VPC flow logs.
NDR's benefits to multicloud security can also include:
- Tool consolidation and integration. Network detection and response can incorporate many monitoring, alerting, and reporting functions within a single framework, and reduce tool sprawl. As a pillar of the SOC Visibility Triad, it often complements EDR, System Information and Event Management (SIEM) and data lakes, Extended Detection and Response (XDR), and other solutions that are common in multicloud and hybrid cloud environments. Cloud-capable NDR will often integrate with CSPM, CWPP, and other cloud-native security solutions.
- Scalability. NDR platforms can support a centralized monitoring and metadata extraction from multiple cloud deployments through strategic sensor placement and without over provisioning of cloud resources. Coupled with an ability to correlate data flows, these features provide NDR with an elastic, scalable design suitable to expanding multicloud deployments.
- Compliance monitoring. In addition to helping with the documentation necessary to prove compliance around data usage and other regulatory requirements, NDR's monitoring capabilities can reveal shadow IT and help SOCs determine if the organization is using cloud tools and services in ways that increase cyber risk.
- Expedited detection and incident response. Enriched network metadata generated and synthesized by NDR platforms can expedite the detection and disruption of cloud-specific threats and malicious tactics such as the use of command and control (C2) channels. It can also highlight behavioral anomalies that may require more investigation or provide a starting point for advanced threat hunting. By providing SOCs with more enriched evidence from cloud network logs, NDR can improve mean time to detect (MTTD) intrusions and increase the likelihood of faster incident resolution.
How Corelight's Open NDR supports multicloud security
Corelight's Open Network Detection and Response (NDR) Platform combines the most robust network evidence and analysis platform with cloud sensors and integrations that create a viable and powerful component to multicloud security. As a vendor-agnostic solution, Corelight complements most CWPP, CSPM, CNAPP, XDR, and SIEM platforms, and includes sensors for GCP, AWS, and Azure cloud infrastructure.
Our NDR capabilities can help SOCs improve multicloud security through core capabilities that include:
- Complete visibility in multicloud and hybrid cloud environments. Corelight's sensors parse north/south and east-west traffic and enable security teams to identify all services within their cloud environments. Consistent network telemetry coupled with host data enrichment enable comprehensive visibility integrated with cloud control planes. Corelight collects detailed network metadata using Zeek® (e.g., HTTP headers, DNS queries, SSL certificates and ciphersuites, bytes transferred) and tracks network sessions, bridging blind spots between container runtime events. Corelight also enriches cloud traffic observed with additional metadata through our Cloud Enrichment and cloud app ID packages:
- Cloud-specific detections. The Corelight NDR Platform leverages the power of the open source community, MITRE ATT&CK mapping, and our own research to provide users with threat detections and intelligence that can detect and disrupt attacks TTPs that target cloud infrastructure, such as lateral movement, data exfiltration, C2 channels, attacks initiated with cloud exploitation frameworks and more. Corelight evidence can help security teams detect cloud hosts that reach out to or access multiple services, and other behavioral anomalies that may indicate stealthy attack patterns.
- AI-powered workflows. Corelight Investigator, the SaaS-based threat hunting interface within Corelight's Open NDR Platform, automates workflows and includes customizable dashboards that expedite and simplify alert triage, and make raw network data and packet capture (PCAP) accessible through simple steps. The platform also includes ML-based summaries, interactive visual timelines and triage history to make incident response more comprehensive, targeted, and efficient.
- Accelerated incident response. Corelight's enriched data helps investigators correlate suspicious or anomalous traffic with specific cloud actions, account movements, and container processes — leading to faster, more accurate threat detection and response.
What is the difference between multicloud security and hybrid cloud security?
Multicloud security focuses on protecting workloads, applications, and data spread across two or more public cloud providers, such as AWS, Azure, and Google Cloud Platform (GCP). Organizations adopt a multicloud strategy to avoid vendor lock-in, optimize costs, and use best-in-class services from each provider. The security challenge is consistency: every cloud has its own native controls, identity models, logging formats, and configuration standards. Enforcing a unified policy across these environments, without gaps or blind spots, is the central task.
Hybrid cloud security covers a different footprint: a mix of on-premises infrastructure (data centers, private clouds, or legacy systems) combined with one or more public clouds. The defining challenge here is bridging two fundamentally different worlds. You’re securing traffic and data as they move between environments you fully own and environments you rent, each with distinct trust boundaries, network architectures, and compliance requirements.
The key distinctions fall into three areas:
- Scope: multicloud spans multiple external providers; hybrid spans the boundary between internal infrastructure and external clouds.
- Complexity: multicloud complexity stems from reconciling several public cloud toolsets; hybrid complexity stems from integrating legacy on-premises systems with modern cloud platforms.
- Control: in hybrid environments, you retain direct control over on-premises assets; in pure multicloud environments, you operate entirely within the shared-responsibility models of your providers.
For most enterprises, these categories overlap. A single organization often runs a hybrid multicloud environment, combining on-premises systems with several public clouds at once.
What is multicloud security architecture?
Multicloud security architecture is the framework of controls, policies, and tooling that protects workloads, data, and identities across two or more public cloud providers, such as AWS, Azure, and Google Cloud Platform (GCP). Its purpose is to deliver one coherent security posture across environments that were not originally designed to work together. A multicloud security architecture has five main components:
- Unified identity and access management (IAM): each cloud ships with its own identity model, permission structures, and role definitions. A sound architecture centralizes authentication and authorization through federated identity and single sign-on, so access follows the principle of least privilege everywhere, not just in your best-managed cloud. This is often the most important control, because identity is a primary attack surface.
- Consistent policy enforcement: security policy should mean the same thing in every environment. Security architectures achieve this by defining controls as code and applying them uniformly across providers, which closes configuration gaps that attackers can exploit and keeps you audit-ready across the board.
- Centralized visibility and monitoring: you cannot defend what you cannot see. Aggregating telemetry, logs, and network evidence from every cloud into a unified view eliminates blind spots, shortens mean time to detect (MTTD) and mean time to respond (MTTR), and gives your Security Operations Center (SOC) a single source of truth instead of disconnected consoles.
- Data protection strategies: consistent encryption in transit and at rest, disciplined key management, and clear data classification ensure sensitive information stays protected as it moves between providers. This is also where much of your regulatory defensibility lives, from SEC disclosure obligations to DORA and NIS2.
- Shared responsibility alignment: every provider draws the line between its duties and yours differently. A mature architecture maps these boundaries explicitly, so nothing falls through the cracks because each team assumed the other had it covered.
For security leaders, the strategic value is clear. A well-designed multicloud security architecture reduces risk through faster detection and response, supports vendor consolidation by unifying tooling across environments, and lowers total cost of ownership by replacing redundant, provider-specific controls with a coherent, integrated approach. In short, it turns the complexity of running multiple clouds into a manageable, provable, and resilient security posture.
What are the most important multicloud security best practices?
Some of the most important multicloud security best practices include centralizing identity and access management, enforcing least privilege, standardizing policy enforcement, consolidating visibility, monitoring network traffic, encrypting data, mapping shared responsibility, adopting zero trust, and automating compliance. Running multiple public clouds ensures redundancy and expanded capabilities, but it also multiplies your risk surface just as fast. The best practices below share a single goal: replace fragmentation with uniform, provable control across every environment. Get them right, and you turn multicloud complexity into a defensible, audit-ready posture rather than a collection of blind spots and inconsistent policies.
Centralize identity and access management (IAM)
Identity is the primary attack surface in the cloud, so unify it first. Federate authentication and enforce single sign-on across all providers, so access decisions follow one consistent model instead of several. A centralized approach also gives you a single place to audit who can touch what, which matters when a regulator or your board asks you to prove it.
Enforce least privilege everywhere
Grant the minimum access required, then review it regularly. Over-permissioned accounts and stale credentials are among the most common root causes of cloud breaches. Apply just-in-time access for privileged roles, expire unused permissions automatically, and treat every standing entitlement as a liability until proven necessary.
Standardize policy enforcement across clouds
Security policy should mean the same thing in every cloud environment, whether it’s AWS, Azure, or Google Cloud Platform (GCP). Define your controls as code and apply them uniformly, so a misconfiguration in one environment cannot quietly become your weakest link. This helps to close the configuration gaps attackers exploit and keeps you consistently audit-ready.
Consolidate visibility and monitoring
You cannot defend what you cannot see. Aggregate telemetry, logs, and network evidence from every cloud into one view, so your Security Operations Center (SOC) works from a single source of truth rather than a stack of disconnected consoles. Unified visibility directly shortens mean time to detect (MTTD) and mean time to respond (MTTR), the metrics that define both your risk exposure and your operational efficiency.
Monitor network traffic across every environment
Configuration and identity controls tell you what should happen; network monitoring tells you what actually is happening. Continuous inspection of east-west and north-south traffic surfaces lateral movement, command and control (C2) activity, and data exfiltration that native cloud logs alone often miss. This behavioral evidence is what lets you validate threats and respond with confidence.
Encrypt data and manage keys with discipline
Protect data in transit and at rest with consistent encryption standards across providers. Pair that with disciplined key management and clear data classification, so sensitive information stays protected as it moves between clouds. This is also where much of your regulatory defensibility lives, from SEC disclosure obligations to DORA and NIS2.
Map shared responsibility explicitly
Every provider draws the line between its duties and yours differently. Document those boundaries for each environment, so nothing falls through the cracks because two teams each assumed the other had it covered. Ambiguity here is how gaps, and breaches, quietly happen.
Adopt zero trust principles
Assume no user, device, or workload is trustworthy by default. Verify every request, segment your networks to contain blast radius, and continuously validate trust based on context rather than location. Zero trust is especially powerful in multicloud, where the traditional perimeter simply does not exist.
Automate continuous compliance
Treat compliance as an ongoing state, not an annual scramble. Continuously assess configurations against frameworks like SEC, DORA, and NIS2, and automate audit-ready reporting, so you can prove your posture on demand. This turns compliance from a recurring fire drill into quantifiable, defensible evidence.
Which AI-driven NDR platforms scale across hybrid and multicloud environments?
AI-driven NDR platforms that scale across hybrid and multicloud environments include the Corelight Open NDR Platform, whose deployment options pair on-premises sensors with cloud sensors for AWS, Azure, and GCP. Whichever platforms you shortlist, evaluating a Network Detection and Response (NDR) platform for hybrid and multicloud scalability comes down to a core set of essential capabilities that determine whether it scales effortlessly or fails under load. Get this right, and you gain unified visibility, faster detection, and a defensible security posture. Get it wrong, and you inherit a stack of disconnected consoles and a growing audit liability.
Gartner’s guidance on the NDR market reinforces this. Its recent Critical Capabilities research advises security leaders to treat unified visibility across all cloud and hybrid environments, with cloud-native telemetry and identity tracking, as a standard requirement rather than a premium add-on. Use that as your baseline. Here is what to evaluate.
Unified visibility across on-premises and every cloud provider
The platform should deliver one coherent view across your data center, private cloud, and each public cloud you run, typically AWS, Azure, and Google Cloud Platform (GCP). Native cloud tools see individual services well, but they were never designed to show how an attacker moves between them. A capable NDR platform correlates activity across all environments in a single timeline, so lateral movement that crosses the seam between on-premises and cloud does not slip through unnoticed.
Cloud-native sensor deployment
Lifting a legacy hardware appliance into the cloud does not scale. Look for cloud-native sensors that deploy alongside dynamic workloads, provision automatically, and analyze traffic locally to keep egress costs in check. This matters most in auto-scaling environments where resources spin up and down constantly. Short-lived dynamic workloads require continuous inspection that scales alongside them automatically.
Behavioral analytics and ML-based detection
Signatures alone cannot keep up with modern threats. Effective platforms must use AI to combat new AI-powered threats and also need to be tailored to the specific environment by establishing a baseline of normal behavior, using machine learning to flag deviations that indicate lateral movement, command and control (C2) activity, or data exfiltration. The strategic payoff is direct: better behavioral detection shortens mean time to detect (MTTD) and mean time to respond (MTTR), the two metrics that most define both your risk exposure and your operational efficiency.
Encrypted traffic analysis without full decryption
Most traffic is encrypted, and full decryption is expensive, invasive, and often impractical at scale. Mature platforms analyze encrypted flows using metadata, TLS fingerprinting, and behavioral correlation, surfacing suspicious activity without opening the payload. This preserves both performance and privacy while closing a blind spot that attackers count on.
Integration with SIEM, SOAR, and EDR
NDR should never operate in isolation. Choose platforms that feed prioritized, context-rich detections into your Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), and Endpoint Detection and Response (EDR) tools using open formats. This is also where integration pays off: an open platform enriches your existing stack rather than adding another silo, which lowers total cost of ownership and strengthens ROI on tools you already own.
Scalability without added infrastructure complexity
The best platforms scale through their architecture, not through a growing pile of appliances or cloud dependencies. Evaluate how a candidate handles high-throughput traffic, how its pricing behaves as bandwidth grows across multiple clouds, and whether coverage expands without proportional operational overhead. Watch for hidden costs here: some vendors require separate licenses per cloud provider, and bandwidth-based pricing can spike unexpectedly in multicloud deployments.
How to evaluate candidates
Rather than relying solely on feature claims, validate each solution through realistic testing scenarios:
- Correlation between a cloud workload and an on-premises system
- Detection of suspicious east-west communication that signals lateral movement
- Investigation of suspicious encrypted traffic without decryption
- A single alert traced end to end without switching tools
- Workload-to-workload activity spanning two different clouds
To learn more, visit our Cloud Security Solutions page, learn about our Cloud Sensors, or schedule a demo today.
Book a demo
We’re proud to protect some of the most sensitive, mission-critical enterprises and government agencies in the world. Learn how Corelight’s Open NDR Platform can help your organization mitigate cybersecurity risk.