By Anant Adya, EVP and Service Offering Head, Infosys
The digital backbone of global enterprise is under siege from two directions at once. Regulators are tightening their grip on how organizations store, move and protect data across borders. At the same time, threat actors are weaponizing artificial intelligence to launch attacks that are faster, more adaptive and harder to detect that anything we have faced before. For enterprise leaders, the question is no longer whether to invest in cloud resilience – it is whether their current posture can hold under the compounding pressure of both forces simultaneously.
A Shifting Regulatory Terrain
Data sovereignty is no longer a concern confined to regulated industries or the European Union. In the past three years alone, more than 70 countries have enacted or materially updated national data protection laws. From India’s Digital Personal Data Protection Act to Brazil’s LGPD to the patchwork of U.S. state-level privacy statutes, the compliance map has become incredibly complex. Organizations that once designed cloud architectures for performance and cost-efficiency must now layer in jurisdiction controls that govern precisely where data lives, who can access it and under what legal authority.
The challenge runs deeper than geography. Sector-specific mandates – from financial services frameworks like DORA in Europe to evolving requirements in healthcare, critical infrastructure and defense supply chains – demand that organizations demonstrate not just compliance at a point in time, but continuous, auditable alignment. Static compliance is giving way to a dynamic model where governance must be embedded into every cloud workflow, not bolted on at the end of a deployment cycle.
The AI-Powered Threat Landscape
On the adversarial side, the threat environment has entered a new phase. AI-enabled cyberattacks are fundamentally changing the economics of intrusion. Attackers can now automate vulnerability discovery, craft highly convincing phishing lures at scale, adapt malware in real time to evade signature-based detection and compress the window between initial access and lateral movement to minutes rather than days. The asymmetry that once favored defenders – who had only to protect while attackers had to find a single weakness – has narrowed considerably.
Cloud environments are a particularly attractive target. The density of sensitive data, the complexity of identity and access relationships and the pace of change in cloud configurations all create fertile ground for exploitation. Misconfigured storage buckets, overprivileged service accounts and shadow workloads running outside formal governance represent the kind of attack surface that AI-powered reconnaissance tools are extraordinarily good at mapping. The cloud’s greatest strength, its flexibility, is also its greatest vulnerability.
Embedding Resilience at Every Layer
Addressing these converging pressures requires a fundamental shift in how organizations think about cloud resilience. It cannot be treated like a security problem alone, or a compliance problem alone. It is an architectural and cultural challenge that must be addressed at every layer of the stack.
At the data layer, enterprises need granular sovereignty controls that can enforce jurisdiction-specific policies dynamically, routing and replicating data based on regulatory requirements without sacrificing operational agility. This means investing in cloud platforms and data fabric architectures that make residency constraints programmable, visible and auditable rather than a manual configuration burden.
At the compliance layer, automation is no longer optional. The speed of regulatory change, combined with the scale and vigor of modern cloud environments, makes manual compliance management difficult. Organizations must build continuous compliance pipelines that monitor configurations in real time, map controls to specific regulatory frameworks and surface gaps before they become audit findings or breach vectors. Policy-as-code approaches, integrated into CI/CD pipelines, allow compliance to travel with workloads from the moment of deployment.
At the threat detection layer, the response to AI-enabled attacks must itself be AI-driven. Traditional security information and event management tools are not equipped to correlate the volume and velocity of signals generated across modern cloud environments. Organizations need behavioral baselines, anomaly detection models and automated response playbooks that can act at machine speed. Equally important is the integration of threat intelligence that reflects the current tactics of adversaries targeting cloud infrastructure specifically, not generic threat feeds designed for on-premise environments.
Governance as a Strategic Capability
Perhaps the most important shift enterprise leaders must make is to reframe cloud governance as a strategic capability rather than a cost center. Organizations that treat compliance and security as reactive obligations will always be playing catch up, reacting to the last regulation passed, the last breach reported, the last vulnerability disclosed. Organizations that embed proactive governance into their cloud operating model will be better positioned to move quickly when the environment changes, because their architecture is already built to adapt.
This requires executive alignment that elevates cloud resilience alongside revenue growth and operational efficiency as a board-level priority. It requires investment in the talent and tooling necessary to operate a compliance automation function at scale. It also requires partnerships with technology providers and advisors who can bring both regulatory depth and cloud engineering expertise, because the intersection of those two domains is where the hardest problems live.
The regulatory landscape will continue to tighten. Threat actors will continue to innovate. The organizations that build resilience as a first principal – not as an afterthought – are the ones that will maintain the trust of their customers, regulators and shareholders in the era ahead. The window to get this right is open now. The question is whether enterprise leaders have the resolve to act before it closes.
##
ABOUT THE AUTHOR
Anant Adya is EVP and GTM Head for Cobalt at Infosys. He and his team are responsible for designing solutions to help customers in their Digital and Cloud journey. Cobalt for Infosys is a set of Solutions, Platforms and Services that help Enterprise Journey to Digital. They also leverage the Infosys Innovation team to partner with the startup ecosystem to co-create solutions for customers. He is very passionate about Industry Clouds, use cases around the 6 Technologies (Cloud, AI, Data, Edge, IoT & 5G) and most importantly working with Enterprises to focus on Business Outcomes.
