TL;DR: Hybrid cloud data security is getting harder as data, keys and audit evidence move across on-premises systems, private data centres and multiple clouds, according to Fortanix, and the average cost of a breach in a hybrid environment is approaching $5 million. Fragmentation, not encryption alone, is the governing problem, because inconsistent key control and logging turn every boundary crossing into an exposure point.
At a glance
What this is: This is a Fortanix analysis of why hybrid cloud data security is becoming more difficult as workloads and sensitive data spread across on-premises, private cloud and public cloud environments.
Why it matters: It matters because IAM, key management and audit controls no longer sit in one place, so practitioners need consistent governance across environments to reduce exposure and prove compliance.
Context
Hybrid cloud data security is the problem of keeping sensitive data, keys and audit evidence governed when they move across on-premises systems, private data centres and multiple public clouds. The security model breaks down when each environment uses different encryption standards, key management approaches and logging formats, so a unified control view becomes difficult to maintain.
The article frames this as a governance gap rather than a tooling gap: teams often have controls in each environment, but not one portable policy layer that follows the data. That matters for identity and access as much as for cryptography, because key ownership and access decisions become fragmented across platforms. For teams that need the identity side of this problem, cloud workload identity is part of the same control story.
Key questions
Q: How should teams govern API keys and tokens across hybrid cloud platforms?
A: Treat them as governed credentials with ownership, rotation, revocation, and audit requirements that apply uniformly across environments. The key test is whether the same control outcome is enforceable in every place the secret can travel.
A: A hybrid cloud breach is a security incident that spans more than one operating environment, such as on premises systems, public cloud services, and private cloud platforms. These incidents are harder to contain because identity, data, and logging controls are often inconsistent across boundaries, which increases investigative and remediation effort.
Q: What breaks when audit logging is split across cloud providers?
A: When audit logging is split across providers, teams lose a single chain of evidence for key access and data protection decisions. That makes it harder to prove who used which key, when policy changed, or whether access matched the approved control model. The result is weaker oversight and slower incident reconstruction.
Q: When should organisations start moving to post-quantum cryptography for network traffic?
A: Organisations should start now when they protect sensitive data with long-lived value, operate critical infrastructure, or expect equipment to remain in service for years. The main risk is delayed migration, because cryptographic transitions take time across inventory, testing, interoperability, and governance. Waiting for a future deadline usually leaves too little runway to change safely.
Technical breakdown
Why fragmented key management weakens hybrid cloud security
Hybrid cloud environments create separate control planes for encryption, identity and audit logging. That means each cloud or on-premises stack can enforce its own key rotation, access policies and logging format, but none of them provide a complete view on their own. The result is not just operational friction. It is a policy drift problem, where the same data may be protected differently depending on where it sits or moves next. A unified key management layer matters because it reduces the number of places where trust assumptions can break. When keys, permissions and logs are split, auditors and defenders lose the ability to trace the full lifecycle of protected data. See the Data Security Guide.
Practical implication: Consolidate key ownership and audit evidence into one governance layer rather than letting each environment drift independently.
How zero trust changes the data protection model
Zero trust in hybrid cloud is not only about user authentication. It extends to how data, workloads and keys are treated as they move across environments. In practice, that means access decisions and encryption policy must follow the data rather than stay anchored to a single perimeter or provider. This is especially important where SaaS, private infrastructure and public cloud all touch the same information set. Once data crosses multiple trust zones, perimeter assumptions fail and identity controls become the mechanism that keeps access bounded. The hard part is ensuring those controls remain consistent when each environment implements them differently. See the Cloud Security Guide.
Practical implication: Apply portable identity and encryption policy so access remains consistent even when the data moves between environments.
Why post-quantum cryptography forces crypto inventory now
Post-quantum migration starts with visibility, not algorithm choice. Hybrid estates usually contain RSA, ECC and other cryptography spread across applications, APIs, storage layers and third-party integrations, and that inventory is often incomplete. If an organisation cannot identify where vulnerable algorithms are used, it cannot sequence migration safely. Crypto agility is the ability to discover, classify and replace cryptography without breaking the surrounding system. In hybrid cloud, that requires awareness of where keys live, which services depend on them and which integrations would fail if algorithms changed. The migration challenge is therefore both technical and governance-led.
Practical implication: Build a cryptographic inventory before planning PQC migration, so high-risk dependencies are identified before they become blockers.
NHI Mgmt Group analysis
Hybrid cloud data fragmentation is the central governance failure, not a side effect. The article shows that organisations do not merely manage more environments, they inherit more key stores, logging systems and access models that do not naturally align. That creates a control gap where encryption exists, but governance does not. For practitioners, the question is whether policy, identity and audit evidence can follow the data across the whole estate.
Key management has become an identity problem as much as a cryptography problem. When cloud platforms and on-premises systems each control their own keys, the real issue is who can authorise use, rotation and revocation at scale. That is why hybrid security programmes need to treat key lifecycle governance as a privileged access issue, not just a storage issue. The control objective is consistent authority over cryptographic assets, not isolated local administration.
Portable control plane: the only defensible answer to hybrid complexity is a policy layer that persists across environments. The article’s strongest point is that security cannot depend on whether data happens to be in AWS, Azure, Google Cloud or a private data centre at a given moment. That is a structural governance problem, and it is directly relevant to identity, NHI and workload access patterns where keys and tokens move with the workload. Practitioners should design for portability rather than environment-by-environment exception handling.
Post-quantum readiness is really an inventory and dependency problem. The cryptographic transition will fail where teams do not know which applications, APIs and integrations depend on vulnerable algorithms. That means the issue is not simply algorithm selection, but mapping the full dependency graph before migration. For security leaders, the practical lesson is to make crypto discovery and governance a programme now, not a future project.
From our research library:
- 82% of breaches involved data stored in the cloud, according to IBM (2024).
What this signals
Portable policy will matter more than local optimisation. Hybrid cloud programmes are moving toward security models that follow data, keys and identities across environments instead of assuming any one provider can serve as the control center. That shift will push teams to standardise governance around movement, not location, and to build control portability into architecture decisions from the start.
Crypto agility is becoming an operational requirement, not a future nice-to-have. The practical pressure point is inventory. Once teams can see where vulnerable algorithms live, they can sequence migration, dependency testing and exception handling with less disruption. For identity-heavy estates, that also means watching how workload identities and integrations depend on the same cryptographic assets.
For practitioners
- Centralise key lifecycle governance Establish one authoritative process for key creation, rotation, access approval and revocation across on-premises and cloud environments. See the Data Security Guide.
- Map where sensitive data lives and moves Build a cross-environment inventory of sensitive datasets, storage locations and movement paths so controls can follow the data.
- Unify audit evidence across providers Consolidate key usage and access logs into a single reviewable record so compliance teams are not stitching together separate logs by hand.
- Start a cryptographic discovery programme Identify which applications, APIs and third-party integrations still rely on vulnerable algorithms before planning post-quantum migration.
- Treat identity controls as portable policy Ensure workload and administrative access decisions remain consistent when data moves between clouds, private systems and SaaS platforms.
Key takeaways
- Hybrid cloud data security fails first at the seams between environments, where separate key stores, access rules and logs make consistent governance difficult.
- The article’s core evidence is that fragmentation raises both operational burden and breach cost, with hybrid incidents approaching $5 million on average.
- Practitioners should respond by unifying key lifecycle control, improving data discovery and building a cryptographic inventory before post-quantum migration becomes urgent.
Related NHI Mgmt Group resources: Data Security Guide · Cloud Workload Identity Guide · Cloud Security Guide · Google Cloud Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST SP 800-57 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Hybrid cloud security depends on consistent access governance across environments. |
| Recommendation — Standardise access permissions for keys and sensitive data across every cloud and on-premises platform. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Key lifecycle management is central to the article’s control model. |
| Recommendation — Apply IA-5 to govern key rotation, revocation and replacement across hybrid environments. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article’s governance gap includes inconsistent control over who can use cryptographic assets. |
| Recommendation — Use account management controls to limit and review access to cryptographic assets and key administration. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | APIs and integrations inherit risk when cryptographic controls and authentication are inconsistent. |
| Recommendation — Harden API authentication paths where hybrid integrations depend on shared cryptographic trust. | ||
| NIST SP 800-57 | Part 1 — Key Management Lifecycle | The article centres on key discovery, rotation and migration across hybrid estates. |
| Recommendation — Inventory key lifecycles now so post-quantum migration can be sequenced without breaking dependencies. | ||
Key terms
- Hybrid Cloud Security: Hybrid cloud security is the practice of protecting systems that span public cloud and on-premises infrastructure. The core challenge is consistent enforcement of identity, data, and monitoring controls across environments that use different native mechanisms and trust assumptions.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- Decentralized Key Management: A model where identity keys are issued, stored, rotated, recovered, and revoked without relying on one central control point. For identity teams, the challenge is not only protecting keys but also preserving accountability and recovery when trust is spread across devices or participants.
- Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps security and identity practitioners connect access control to the broader governance model their programmes need.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org