The State of Cloud Remediation 2026
How long findings really stay open, who closes them, and what separates a detection platform from remediation that reaches production. Fieldwork across 340 multi-cloud programmes in North America and Western Europe.
Sponsors fund the fieldwork and receive no review, approval or editing rights over the findings. No vendor named in this report paid to appear in it. Read our editorial standards.
The short version
Cloud security teams are not short of signal. The median programme in this panel receives 1,340 new findings a week and closes about one in nine of them. Critical findings sit open for 147 days, and the number has moved by four days in two years while detection coverage has roughly doubled.
The programmes that break the pattern did not buy a better scanner. They put a named human behind closure, generated fixes specific to their own environment, and verified the result by re-scanning rather than by closing the ticket.
Unlocks the full report on this page: four chapters, three figures, the vendor scorecard and the methodology note.