Protecting Data in the Cloud – It’s the Wild West Out There

As organisations spread their workloads across multiple cloud platforms and SaaS tools, most assume their cloud provider is keeping their data safe. But under the shared responsibility model outlined in nearly all cloud service agreements, the provider is only responsible for securing the infrastructure, and the customer is responsible for protecting their data.

The real issue? As Simon Pamplin, CTO, Certes, points out, customers have no influence over what security controls the cloud provider implements, nor do they have visibility into how those controls operate. So, how do you protect the data you’re accountable for when you have no control over the environment it’s hosted in?

Wrap security around the data

Today’s cloud landscape demands a new approach: one where protecting the data itself, not just access to it, must become the new frontier. In a multi-cloud, hybrid world, the answer is not to depend on infrastructure security you can’t control, but to wrap security around the data itself to regain sovereignty over your most valuable asset. This is where Data Protection & Risk Mitigation (DPRM) comes into play.

DPRM takes a data-centric approach to security, ensuring that sensitive information is encrypted, policy-controlled, and immutable wherever it travels. Whether the data is in motion, at rest, or in use, it remains under the business’ control, not the provider’s. This separation of data security from infrastructure security gives organisations the visibility and protection they need in a cloud environment that offers little transparency.

Answering the key questions

How do you protect your data when you move to the cloud?

With DPRM, protection moves with the data. This means it doesn’t matter if your data is in AWS, Azure, Google Cloud, or moving between all three. Protection is applied at the data layer, not just at the transport or infrastructure level, and access is governed by granular, risk-based policies defined by you.

Most critically, access remains under your control. This prevents exposure through third-party breaches, misconfigurations, or supply chain vulnerabilities. You own the keys. You own the policy. You stay in control.

What about the impact of Zero Day Vulnerabilities?

Zero-day attacks exploit unknown or unpatched vulnerabilities in applications and systems. These can be devastating, especially in cloud environments where software dependencies are sprawling and visibility is limited.

But here’s the hard truth: you can’t patch what you don’t know about, and you can’t prevent every breach. What you can do is ensure that when attackers get in – and they will – they find nothing of value.

By devaluing the data through protection and policy-wrapping, DPRM ensures that even if zero-day vulnerabilities are exploited, the breach is meaningless. There is nothing readable, nothing sellable, nothing actionable for attackers to use.

How do you deploy Quantum Safe Immutable Backup?

Quantum computing is closer than we think,  and with it comes the ability to break traditional data protection standards like RSA and ECC. The risk isn’t just future-based; it's already here in the form of "harvest now, decrypt later" attacks, where adversaries collect encrypted data today with the intention of decrypting it once quantum capabilities mature.

To defend against this, organisations need to implement Quantum Safe Immutable Backup now. This needs to support post-quantum cryptography (PQC) standards, enabling data to be encrypted using quantum-resistant algorithms. Combined with immutable storage policies, where backups cannot be altered or deleted, this creates a powerful shield against both conventional and quantum threats.

And critically, this can be deployed without rewriting applications. Quantum-safe encryption on top of existing systems means there is no need to rip and replace.

What is a Virtual AirGap and why does it matter?

Traditional air-gapped systems (those physically isolated from networks) are often cited as the gold standard of security. But in today’s connected cloud environment, they are rarely practical. That’s where the Virtual AirGap comes in.

With DPRM, organisations can segment applications and services by policy, restricting access and visibility based on role, risk, and context. The principle is simple: you can’t attack what you can’t see. Sensitive workloads can be effectively cloaked, making them invisible and inaccessible to unauthorised users, including attackers who may already be inside the network.

This policy-driven invisibility delivers the benefit of isolation without disconnecting systems. It’s a smarter, more scalable version of the air gap for the cloud era.

Final word: take back control

The cloud has given businesses unprecedented flexibility, but it’s also created a dangerous illusion of safety. The shared responsibility model leaves the burden of data protection squarely on the shoulders of the customer, while offering little control over the environment where the data sits.

Businesses must review the only realistic way forward and take ownership of their data and wrap protection around it, wherever it lives. Enforce consistent, quantum-safe, policy-driven protection at the data layer, across any cloud or hybrid environment.

In the Wild West of cloud computing, data protection is your sheriff, your saloon doors, and your vault. You can’t change the landscape, but you can control what’s yours.

And that’s the key to real security in a lawless frontier.