Data security in the age of the cloud and AI: five key action areas

The cloud is well established as an indispensable element of company infrastructure, but it is also fundamentally changing data security requirements. Today’s data is stored in hybrid and multi-cloud environments. The multiplicity of platforms, providers and responsibilities makes uniform management of security policies difficult. Then there are the new technological concepts, such as containers and microservices. ‘In hybrid and multi-cloud environments, the high level of scalability, the use of microservices and the dynamics of the cloud significantly increase complexity,’ says Peluso. 

This complexity is a breeding ground for mistakes, according to the cybersecurity specialist. ‘Many security incidents are caused by misconfigurations and excessive access rights rather than sophisticated attacks. There are also risks associated with unclear responsibilities, dependency on cloud providers and issues of data sovereignty. In Switzerland in particular, companies have to prove adherence to regulatory and compliance requirements across all platforms.’ 

The question of data security goes beyond technical protection measures. It also affects the digital sovereignty of a company. The Swisscom Cybersecurity Threat Radar 2026 lists digital sovereignty as one of the most important developments in the security environment. If you don’t know where your data is being processed, who can access it and what legal framework conditions apply to cloud providers, you risk losing control in the long term.

So it is important to not view cloud security in isolation as an infrastructure issue. Instead, it is a key component of modern data security. Companies need transparency around cloud workloads, consistent security policies and a clear understanding of what data is processed where. Cloud governance, cloud security assessments and technologies such as CSPM (cloud security posture management) and CWPP (cloud workload protection platform) can help companies regain this control. 

Few technology topics are currently preoccupying companies as much as artificial intelligence. The advantages are obvious: generative artificial intelligence (GenAI) in particular increases productivity, speeds up processes and creates new opportunities for innovation. At the same time, we are seeing new risks for data security emerging. Employees use AI services, upload documents or enter information in prompts. And AI functions are increasingly being integrated directly into business applications.

So the challenge is not AI itself. But it does make existing problems more visible and even amplifies them. Data security was a governance function before the rise of GenAI. But AI acts as an accelerator because data is processed, shared and used more quickly and on a larger scale.‘

AI governance is of key importance to Swiss companies,’ says Peluso. ‘It creates the guidelines required for the secure, transparent and responsible use of AI.’ Effective AI governance helps companies reduce data breaches, bad decisions and uncontrolled data use. At the same time, it builds trust. ‘AI governance helps companies realise the business benefits of AI in a sustainable and controlled way and to increase innovation and efficiency,’ adds Peluso. 

The current Cybersecurity Threat Radar also shows that these risks are not theoretical. It cites ‘insecure AI’ as one of the most important challenges for companies in this regard. Insecure AI systems can disclose confidential data, create new areas of attack and cause regulatory risks. This makes transparency, clear responsibilities and effective AI governance all the more important.For CIOs and CISOs, this means neither blocking the use of AI nor allowing it to proliferate unchecked. A successful approach involves clear rules and responsibilities as well as control mechanisms. This makes data security an enabler for innovation rather than a brake. 

Regulatory requirements are increasing. Data protection laws, industry-specific requirements and internal governance guidelines increasingly require companies to prove how they handle sensitive data.

But compliance doesn’t start with an audit. It starts with transparency, as Peluso emphasises: ‘Transparency is a prerequisite for everything – especially when it comes to verifiability. You can only verify what you have made transparent beforehand.’ 

Many companies still regard compliance as an obligation. But successful organisations see it as the outcome of good data security. Or, as Peluso puts it: ‘Transparency and verifiability form the basis for effective governance, audits and regulatory compliance. Without this transparency, it is almost impossible to meet requirements around data protection, information security and AI governance.’ The positive effect extends beyond the boundaries of the company: ‘Traceability and documented processes create trust among customers, partners, supervisory authorities and auditors,’ says Peluso.

Cyber resilience is often associated with the ability to detect and respond to cyber attacks. But there’s more to it; resilience starts much earlier than that. It starts with the question of which data is critical for business operations, where it is located, who has access to it and how the ‘crown jewels’ are protected. So data security protects not just information, but also the company’s scope for action.‘

Today, data is one of a company’s most important resources and a preferred target for cyber attacks. That’s why data security is key to a company’s cyber resilience – without data security, there is no true cyber resilience,’ says Peluso. 

The better a company handles transparency, control and protection of data, the greater its resilience in the face of cyber attacks and operational disruptions. This involves the interlinking of different disciplines: data loss prevention, the security operations centre, threat detection and response (TDR), extended detection and response (XDR), CASB solutions and security awareness all work in harmony to identify risks early on and limit the impact of incidents.

But it takes more than just technology. The interplay between transparency, governance and operational security is key. A company can claim cyber resilience when it knows at any given time which data is critical for its business operations and how it can be protected. 

Data security is evolving from a technical discipline into a strategic management function. Cloud platforms, SaaS applications and AI are creating new opportunities for innovation and productivity. At the same time, they are increasing requirements for transparency, control and governance.

The five action areas are closely linked:

• Create transparency
• Control cloud environments
• Manage AI responsibly
• Make compliance transparent
• Boost cyber resilience

Raffael Peluso: ‘Transparency is the starting point, and cyber resilience is the goal. Without transparency around data, systems, access rights and how they are used, sustainable data security is almost impossible.’ 

For companies that are already on the right track in terms of transparency, Peluso says ongoing consistency is the way to go: ‘The focus should be on the consistent implementation and enforcement of security and governance measures. Companies need to ensure that sensitive data is only accessible to authorised individuals, that misconfigurations are minimised, and that security policies are consistently applied across hybrid cloud and AI environments.’ 

For CIOs, CISOs and IT managers, the key is not to protect individual technologies. Instead, the challenge is to view data, the cloud, AI and governance as one coherent system. ‘Automation, continuous monitoring and AI governance are becoming increasingly important. They reduce risks and strengthen the organisation’s long-term resilience to cyber threats,’ says Peluso.

Which means: by retaining control over your data, you’re laying the foundation for security, compliance and long-term digital sustainability.