Cloud security in the AI era: why modernization is the moment to reset

Security problems don’t always start with a vulnerability in a newly deployed workload. Sometimes they start with an architecture decision made years earlier or an application code that is decades old. As organizations modernize, they inherit those decisions: the way applications were written, how they connect, how data moves, who has access, and where security controls sit. What worked for one environment can become a constraint­—or a risk—in the next.

IBM Consulting works closely with clients building on AWS, and together we see this tension regularly. Organizations are moving aggressively toward cloud migration and modernization to unlock the benefits of AI, data and automation. The pressure to move quickly is real. But modernization can no longer be only about delivering new capabilities or the economics of cost savings. It is also the opportunity to address the security decisions organizations have inherited and avoid creating the next generation of them.

The security conversation has shifted from what needs to be protected today to what the organization needs to be ready for next. In 2026, that shift has a clear driver. AI stopped being the attacker’s assistant and became the attacker’s operator, and that single change rewrites the conversation for every customer. Four areas in particular define what readiness now requires: securing AI at machine speed, governing agentic AI systems, resetting the cloud security foundation during modernization, and planning for the quantum-safe horizon.

Would your team catch the next zero-day in time?

Join security leaders who rely on the Think Newsletter for curated news on AI, cybersecurity, data and automation. Learn fast from expert tutorials and explainers—delivered directly to your inbox twice weekly. See the IBM Privacy Statement.

Frontier AI is changing more than the threat landscape. It is changing the time organizations have to react.

As AI becomes embedded across applications, workflows, and business processes, the window between a security issue emerging and its business impact is shrinking. Threat actors use the same capabilities to accelerate and scale attacks, and the controls designed for human speed and orchestration cannot keep up on their own. IBM’s Cost of a Data Breach research puts a number on it, where AI-driven attacks added an average of $1 million to the cost of a malicious breach— what once took weeks can now increasingly happen in days. At the same time, growing dependence on interconnected platforms and providers raises the need for trust across partners, providers, and customers. The conversation becomes less about controlling innovation and more about securing it.

From IBM Consulting’s vantage point delivering these programs, the practical lesson is that the security foundation for AI has to be built before scale makes weaknesses harder to contain, spanning identity, data access, governance, monitoring and response. The objective is not to put another gate in front of innovation. It is to make speed sustainable.

AWS gives that principle a concrete shape through its AI Security Framework, a simple 3x3x3 model that AWS and partners use to structure any AI security conversation: three use cases (AI that Answers, AI that Connects, AI that Acts), three layers of control (Infrastructure, Identity and Data, AI Application), and three phases (Foundational, Enhanced, Advanced). The guiding idea is extension AI on top of the security you already run rather than replacing it. As a workload moves from AI that answers (generative productivity) to AI that connects (retrieval and tool use) to AI that acts (agents that transact across systems), the controls accumulate, with proven services like IAM, KMS, GuardDuty, and Amazon Bedrock Guardrails extended into the AI layer. Purpose-built capabilities such as Amazon Bedrock AgentCore add to give autonomous agents their own identity and least-privilege boundaries. The result is defense in depth, where bypassing one control still leaves the next in place.

This is where IBM Consulting turns the framework into real-world delivery, helping secure AI deployments while also using AI to strengthen overall security posture. For example, to address the emerging threat of Frontier AI models that can autonomously discover vulnerabilities and carry out complex machine-speed cyberattacks, IBM helps clients defend their environments by using AI to identify hidden weaknesses before attackers can exploit them. IBM can also help clients deploy autonomous security systems that support real-time monitoring and self-healing threat response.

Agentic AI systems can boost productivity by automating routine tasks around the clock. However, because they can act autonomously rather than simply provide curated answers, they require strong security oversight and governance. Without proper controls, they could access unauthorized information, make harmful decisions, or be manipulated into unsafe actions. Comprehensive safeguards should restrict their permissions, detect anomalous behavior, and ensure human intervention when needed. These measures help prevent errors, protect data, and keep systems secure.

To put these safeguards into practice, organizations need a framework for identifying AI assets, managing identities, protecting data integrity, building resilience, and testing system security. Ongoing governance should verify that controls remain effective and that AI systems operate safely and as intended. This approach enables organizations to manage risk, deter misuse, and respond quickly to emerging issues.

If AI is changing how quickly organizations need to respond, cloud posture determines what they are responding from. This matters most in highly regulated industries like banking, energy, and government where compliance requirements are non-negotiable, and nowhere more than in Europe, where DORA, NIS2, the EU AI Act, and the Cyber Resilience Act all carry deadlines landing through 2026 and 2027.

A recent Energy Sector client makes for a perfect example. Before pursuing broader modernization, the company migrated its mission-critical environment to AWS to establish a more resilient and secure foundation. The move improved system performance by 35 percent, strengthened business continuity, reduced operational complexity, and created a platform for future innovation. The lesson IBM draws from engagements like it is consistent, where too often organizations focus on what they want to build before evaluating where they are building it.

That is why compliance, security guardrails, and governance controls need to be embedded within cloud landing zones from the start. Nobody wants to build on top of a landing zone where compliance is already upside down, and misconfigurations and policy drift remain leading causes of cloud security incidents. Just as important is understanding how applications communicate and depend on one another before they move, because without visibility into traffic flows and dependencies, teams can inadvertently create disruptions or expose sensitive pathways. This discovery, dependency-mapping, and landing-zone design is core to IBM’s migration and modernization practice, and AWS provides the native guardrails and governance tooling that make the resulting posture continuously enforceable. Modernization is far easier when you know what you are migrating, where it is connected, and what it must meet before it arrives.

For European customers there is a further tailwind. The AWS European Sovereign Cloud, live since January 2026, is a separate, EU-operated, physically and logically isolated cloud with EU-controlled governance. Regulation, data residency, and operational autonomy are converging into a single customer demand, and IBM Consulting’s Managed Security Services local delivery footprint lets partners package security, EU sovereignty, and compliance as one compliance-native story that few global competitors can match.

Quantum computing is often treated as a future problem, and that is a mistake. IBM’s The Enterprise in 2030 research notes that while 72 percent of executives expect security to be a board-level mandate equal to financial performance by 2030, only 34 percent are actively preparing to be quantum safe today. Meanwhile regulations for quantum-safe computing are emerging, with key milestones including NIST’s first post-quantum standards being established in 2024, broad migration efforts through 2030, and 2035 as a hard timeline to complete the end to end migration to post quantum cryptography .

Threat actors are already harvesting sensitive data now with the expectation of decrypting it years from now, once the technology matures. For organizations managing sensitive customer data, intellectual property, critical infrastructure, or regulated information, that is a very real concern. Cloud workloads being migrated and modernized today will likely remain in operation well into the quantum era, the cryptographic decisions being made now will shape security outcomes years down the road.

The good news is that organizations don’t need every answer today, they need visibility. That starts with understanding and inventory of their Cryptography posture, where quantum-related risks exist across their environment, and what a transition to post-quantum cryptography could look like. Those who start planning early have far more options than those forced into reactive change later.

Organizations also don’t have to start from scratch. IBM Consulting, drawing on IBM’s long investment in quantum computing and cryptographic research, and AWS are already helping enterprises prepare for a quantum-safe future through cryptography modernization, risk visibility, and resilient cloud architectures, strengthening security and operations before quantum threats become mainstream.

The strength of this partnership is that each side brings a half that the other needs.

AWS brings two decades of cloud, security, and AI, treating AI security as the next chapter rather than a new initiative. That includes threat intelligence operating at enormous scale, a full stack that runs from hardware isolation through purpose-built agent security, data privacy where a customer’s data never reaches model providers, and standards leadership as the first cloud provider certified to ISO 42001 for AI management systems. Defenders get AI too, with AWS Continuum delivering autonomous, on-demand penetration testing that compresses testing from weeks to hours. Security for AI, and AI for security.

IBM Consulting brings the delivery muscle and expertise with cybersecurity consulting and managed services, combined with deep industry depth, helping establish client trust that translates into business outcomes. IBM’s Cybersecurity Services teams carry decades of experience securing regulated enterprises, its research arm produces the Cost of a Data Breach and Enterprise 2030 studies that frame the risk, and its global footprint means these programs land locally, in the regulatory and sovereignty contexts customers operate in.

AWS’s new AI Security Competency category underscores the growing importance of securing AI workloads. With the market still maturing in EMEA, there is an opportunity for IBM Consulting and AWS to help clients navigate this emerging landscape with confidence.

Cloud migration and modernization are no longer purely technology initiatives. Security is becoming a business enabler that helps organizations move faster, innovate with confidence, and build resilience for what is next.

Frontier AI security, cloud security posture, and quantum-safe planning are not independent challenges. They are three expressions of the same shift, where security architecture is becoming modernization architecture. The question leaders should be asking is no longer simply “how do we secure our cloud environment?” It is “are the security decisions we are making today giving us more freedom to modernize tomorrow, or less?” That means operating securely at AI speed, understanding the dependencies and risks being migrated, and building systems that can adapt to the security requirements coming next.

Start with what you already run. Add what is new. Build governance before you scale.

Michael Massimi

Global Principal

Cloud Security Services, IBM

Brian Mendenhall

Worldwide Leader, Security Partner Strategy at Amazon Web Services (AWS)