Defending the Distributed Skies: A Comprehensive Literature Review of the Arena of Multi-Cloud Environment

Abstract

The rapid implementation of multi-cloud architectures, such as the integration of services from multiple cloud providers, gives organizations enhanced flexibility, resilience, and vendor independence. However, the multi-cloud model presents complicated security challenges due to diverse platforms, fragmented governance, and increased areas of concern. This paper presents a comprehensive literature review of the multi-cloud environment arena, focusing on the analysis of threats, vulnerabilities, cost optimization, mitigation strategies, and research trends. It covers a comprehensive range of risks, including data breaches, insider threats, API exploitation, configuration errors, and emerging multi-vector attacks, as well as the cumulative complexity of aligning policies, managing identities, and ensuring compliance across diverse providers. The review analyzes existing and proposed defence mechanisms, spanning cryptographic techniques, fuzzy-logic decision frameworks, AI and ML-driven detection systems, as well as integrated Identity and Access Management (IAM) systems. Analysis of relevant literature reveals a progression from basic foundational encryption systems toward more sophisticated, policy-driven, and collaboration-capable security frameworks. Additionally, the paper identifies significant research gaps in real-world validation, cost optimization, and unified governance models. This research departs from prior work by integrating multiple perspectives rather than limiting its scope to a single area such as security, defence, or cost optimization. It also provides new researchers with comprehensive background information on cloud architecture within a single article.

1. Introduction

The Cloud has emerged as a transformative force for entire industries, not only revolutionizing IT but also driving immense changes in sectors worldwide. It is observed that adaptation continues to accelerate, driven by growing demand for scalable and affordable infrastructure services that provide fast access to applications. The recent statistics illustrate that the cloud’s market share achieved 43% agility [1,2], as it has been mostly adopted by small to medium-sized enterprises, in particular, who have embraced cloud solutions to lower infrastructure expenditures and improve operational agility [3,4]. Financial services firms are leading the charge in adopting multi-cloud approaches as more than 90% of businesses worldwide use cloud computing in their operations [5]. In addition, 84% of organizations report that their workloads are distributed across various cloud services, and tech companies are twice as likely as other industries to have recently hired new cloud professionals [5]. Although cloud computing provides a range of services, including infrastructure, platforms, and applications, ensuring the security of sensitive big data remains a significant struggle. Industries such as healthcare, defence, and government routinely store confidential information in cloud environments, yet users often lack confidence in their providers’ protective measures [1]. Cloud environments encompass a variety of components, including networks, operating systems, memory management systems, and even databases, all of which can be targeted by different types of security attacks [1]. The conventional dependency on a single cloud provider in the cloud computing space is diminishing due to concerns related to service availability and security threats, such as potential malicious insiders.

Figure 1 highlights the evolution of cloud computing from virtualization in 1967 to modern AI, the Internet of Things (IoT), and edge computing. It highlights key developments, such as SaaS, hybrid cloud, and the shift toward intelligent and distributed systems.

As a result, there is an increasing adoption of multi-cloud strategies frequently referred to as inter-cloud or cloud-of-clouds, where services are distributed across multiple cloud providers. This shift demonstrates the evolution of cloud computing from centralized, replication-focused systems to more diverse, technology-driven solutions tailored to specific contexts, and it is vulnerable to attacks [1,24,25,26]. Consequently, businesses are now at times orchestrating workflows in a sequential or parallel manner across multiple providers, leveraging the flexibility and resiliency to run their applications, which is referred to as a multi-cloud approach. A multi-cloud environment combines and interconnects two or more private or public cloud platforms to leverage their collective strengths, such as optimizing data storage capacity, improving security measures, ensuring confidentiality, facilitating efficient sharing and collaboration within disparate systems [27,28,29]. The Futurescape report issued by International Data Corporation predicted, in the context of multi-cloud adoption, that by 2020, more than 85% of large enterprises would have shifted their IT operations to a multi-cloud environment [27,30,31].

Despite the many advantages of multi-cloud, it still lacks in ensuring the security of stored data. To address this issue, many researchers have focused on multi-cloud approaches to enhance data security [1,4,32]. This paper concentrates on the major data security issues and research gaps in multi-cloud environments. It analyzes how sharing data across multiple potentially untrusted cloud providers raises risks, particularly concerning highly sensitive information such as medical records, military or government data, and credit card information. It emphasizes the methods that prevent external attackers and malicious insiders from accessing the data.

To the best of our knowledge, limited prior reviews have simultaneously examined the interconnections among core domains of multi-cloud research. This study integrates four primary perspectives, such as security, Identity and Access Management (IAM), data provenance, and SLA or cost-aware orchestration, into a unified taxonomy and analytical framework. By correlating these axes through consistent evaluative criteria and comparative discussion, the paper provides a balanced and comprehensive understanding of multi-cloud environments that extends beyond domain-specific analyses. In alignment with this aim, the primary objectives of this study are the following:

• Comprehensive literature review of multi-cloud security: Comprehensive collection and synthesis of recent research on threats, defences, and operational concerns in multi-cloud environments.
• Taxonomy of attacks and defence families: Clear classification of threat classes and countermeasure categories.
• Comparative trade-off analysis: Evaluation of security techniques in terms of cost, latency, complexity, and deployment feasibility across providers.
• Identification of critical gaps, practical research agenda, and recommendations.

The rest of the paper is organized as follows. Section 2 provides background on cloud service models, deployment types, and traces the evolution of hybrid IT and multi-cloud strategies as well as their motivating trade-offs. Section 3 analyzes the threat landscape and specific attack classes that affect multi-cloud systems. Section 4 presents a comparative study of prior works. Section 5 discusses persistent security challenges unique to multi-cloud architecture. Section 6 surveys possible solutions and frameworks, also highlights emerging technologies and enterprise-grade solutions, primarily to influence multi-cloud security. Section 7 synthesizes the most important research gaps and recommended directions for future research. Conclusions along with forthcoming research and evaluation priorities are discussed in Section 8.

2. Background

Cloud refers to a model of service delivery that enables users to access IT resources such as servers, storage, and software from a shared pool on the internet, thereby providing ubiquitous and on-demand access [33,34]. In the same way that a utility functions, it abstracts the complexities of underlying hardware and software infrastructures from end users. Most importantly, the term “cloud” gained the most user traction in 2006, which led to a surge in its popularity [35]. The term “cloud computing” refers to a specific area of interest within distributed computing, specifically the delivery and use of services provided by providers such as Google, IBM, Amazon, and others. Although often referred to as an advanced and sophisticated paradigm, cloud computing has existed for several decades [36]. The National Institute of Standards and Technology (NIST) [4] describes cloud computing as

Definition 1.

A model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

Figure 2 highlights cloud computing as a virtualized, service-based model that offers scalable, real-time access to IT resources. It emphasizes mobility, data center delivery, shared infrastructure, and consumption-based billing.

Cloud computing offers a cost-effective approach to managing modern IT applications and systems by enabling efficient resource allocation and utilizing a pay-per-use billing model [45,46,47,48,49,50]. It supports automatic scaling based on demand, minimizes initial capital expenditures through a pay-as-you-go pricing structure, and enables the rapid deployment of applications in virtualized environments [51,52,53]. In subscription-based service frameworks, the reliability and integrity of technical support are ensured through service-level agreements (SLAs) [36]. Through the use of distributed and redundant infrastructure, cloud services offer high availability, improved reliability, and robust security while also providing integrated disaster recovery and compliance with regulations. As a result, this model enables organizations, particularly small and medium enterprises, to concentrate on innovation, leverage advanced technologies such as big data analytics and machine learning, and engage in seamless global collaboration with reduced latency [54]. Thus, cloud computing has emerged as a critical component for contemporary organizations that want to achieve greater agility, operational efficiency, and sustained competitive advantage. The Cloud computing architecture comprises two primary components [36]. The front end, as the user-facing segment, encompasses the interfaces and devices that enable clients to access and interact with the system. The back end, as the infrastructural segment, consists of servers, storage devices, networking equipment, and other resources that provision and support cloud services. Together, these front-end and back-end elements form the complete cloud computing environment, with the user interface serving as the principal endpoint for user engagement.

Figure 3 illustrates the layered cloud computing model, detailing user interaction with SaaS, PaaS, and IaaS through networks and front-end interfaces. It highlights how providers manage infrastructure, APIs, and security to deliver services.

2.1. Cloud Service Providers

Cloud computing underpins a broad spectrum of business services by providing demand-driven computing capabilities that are scalable and available on demand. Cloud service providers offer a variety of storage solutions, including object, block, and file storage—tailored to meet diverse data requirements [56]. These services are hosted in large-scale distributed data centers that span multiple geographic locations [57]. Providers strategically balance the efficient utilization of physical infrastructure with the optimization of network performance and cost-effective resource allocation. Fundamentally enabled by virtualization technologies and distributed network architectures, cloud computing empowers users to access a wide range of services without the need to own or manage physical infrastructure. This model provides scalable, cost-effective technology solutions for both enterprises and individual users [58]. Cloud computing is a service-oriented model that offers pay-per-use infrastructure, platforms, and software as services over the Internet [36,57,59]. Initially, this field emerged with Information- as well as Software services through Amazon Web Services and Salesforce.com, further branching out vertically through a middleware framework called Platform-as-a-Service [60]. This development, demonstrated by platforms such as Force.com and Google App Engine, streamlines resource consumption and facilitates cloud-based application development [60].

Cloud-based storage offerings are engineered to address a wide range of needs, for instance, object storage holds large amounts of unstructured data, block storage supports virtual machines, and file storage shares data through network-attached storage [56]. Additionally, cloud platforms enable data access and manipulation through services such as Amazon S3, Microsoft SkyDrive, and Amazon EC2, while also supporting collaborative activities and version control through tools such as Google Apps and repository services [4,61]. Beyond individual or small-scale applications, cloud computing plays an integral role in enterprise operations. For example, it supports large-scale media delivery as seen with Netflix, and extends to routine services such as email backup through Gmail and synchronization with smartphones [62,63].

Table 1. Cloud Providers and Services provided by them [37].

Cloud Provider	Cloud Service	Service Model	Service Function
Amazon	EC2	IaaS	Server
Amazon	S3	IaaS	Storage
Google	GAE	PaaS	Development Environment
Microsoft Corp	Windows Azure	IaaS	Storage
Microsoft Corp	Office 365	SaaS	Office Suite
Salesforce	Salesforce Service Cloud	SaaS	Customer Relationship Management
CDC Software (APTEAN)	Pivotal CRM	SaaS	Business Customer Relationship (Built on Amazon Service)
eBid Systems	ProcureWare	SaaS	Procurement System
Procore	Procore Construction Project Management Software	SaaS	Project Management System
e-Builder	e-Builder	SaaS	Construction Management Software
Oracle	Aconex	SaaS	Project Management System
Amazon	AWS EMR	SaaS	Hadoop Framework

highlighted the summarization of cloud services from major providers, categorized by service model (IaaS, PaaS, SaaS) and their core functions. It highlights how different platforms support various computing needs, including storage, Customer Relationship Management(CRM), project management, and development.

Ensuring the security of customer data represents a primary obligation for cloud service providers, who must also accept accountability for any vulnerabilities that might compromise their clients’ service infrastructures [4]. By actively leveraging cloud-based networking and infrastructure platforms, users obtain rapid, location-independent access to information, extensive data storage and recovery capabilities, robust defences against unauthorized intrusion, and fine-grained, on-demand security controls [64]. Furthermore, deliberate optimization of cloud services across emerging domains such as microservices architectures, big data analytics, the IoT, and eScience holds significant promise for advancing both industrial applications and scholarly research endeavours [65,66,67].

2.2. The Evolution of Hybrid and Multi-Cloud

The cloud computing market is expanding quickly, with a valuation of USD 0.68 trillion in 2024 and is expected to reach USD 1.44 trillion by 2029. This demonstrates a solid CAGR of 16.40% in the coming years [5]. The growth of the Internet of Things fuels the expansion. The shift in data characterizes the IoT paradigm, which has transitioned from centralized locations to edge-computed locations; therefore, traditional cloud computing is less efficient than distributed computing CapEx and OpEx services, as the number of computing and storage services required is overwhelming [24]. Initially, as cloud computing companies migrated their applications and workloads onto the public cloud, they quickly realized that relying on one single cloud service provider did not provide the best scalability, cost management, or performance [36]. Across recent years, Cloud services have evolved from a single external computing service provider to a broad, context-aware, and technology-driven system, resulting in users moving from dependence on a single cloud vendor to multi-vendor cloud services. The optimization of multi-cloud approaches has been driven by concerns regarding service downtimes or failures, as well as hostile insider risks in single cloud environments, which have set the stage for inter-cloud and cloud-of-clouds concepts [4,24]. To maximize the available resources in a flexible, powerful, and efficient manner, organizations have adopted hybrid and multi-cloud strategies, which outsource both private and public cloud IT services [64,68]. Multi-cloud is a unified cloud service that enables the integration of multiple cloud services from different providers to optimize the workload hosting, data storage, security, and sharing [27,28,29]. In a single cloud environment, an attack may compromise the data confidentiality, leading to data loss, and subsequently resulting in data unavailability [69,70]. Conversely, utilizing a multi-cloud approach mitigates this risk by replicating data across multiple cloud infrastructures; if one cloud is compromised, another continues to provide the necessary data, ensuring its availability remains unaffected [4,69]. This allows companies to optimize resource utilization by leveraging the capabilities of each provider, minimizing the risks associated with vendor lock-in. Additionally, businesses can change service providers or bring on new offerings without hassle as their needs change [27,71,72,73]. In contrast to hybrid cloud strategies that combine private and public clouds to maximize resource utilization, multi-cloud approaches focus on utilizing different public cloud vendors such as Amazon Web Services, Azure, and GCP for specific business requirements [73]. Despite the difficulties faced, the institutions are still implementing hybrid and multi-cloud approaches to enhance performance and minimize risks, which stresses the need to analyze these shifts for optimizing the security of cloud ecosystems while ensuring their growth [5].

The challenges, benefits, and characteristics of the different cloud computing deployment models are highlighted in

Table 2. Overview of Cloud Deployment Strategies with Benefits and Challenges of Cloud Deployment Models [74].

Deployment Model	Description	Advantages	Disadvantage	Challenges
Single-Cloud	A computing environment where all applications, IT resources, and services are hosted and managed by one cloud provider.	Offers simplified management and cost efficiency by delivering consistent performance through a unified provider ecosystem.	Increases the risk of vendor lock-in and service disruptions while limiting flexibility and provider choice.	Such as vendor lock-in, limited flexibility, and susceptibility to provider outages.
Multi-Cloud	An approach that leverages multiple cloud providers to host various IT resources, optimizing flexibility, performance, and resilience.	Enhanced flexibility and resilience while providing access to best-of-breed services and avoiding vendor lock-in.	Increases complexity in management, security, and cost optimization due to diverse architectures across providers.	Complex management, integration, security, governance, and cost optimization issues.
Hybrid Cloud	Integrates on-premises, public, and private cloud environments to enhance flexibility and scalability.	Delivers flexibility, scalability, and enhanced security by balancing workloads across on-premises, public, and private clouds.	Costly and complex to manage due to integration challenges and the need to maintain both private and public infrastructures.	Complex integration and management, data sovereignty and security concerns, and higher costs of operating dual infrastructures.

. The model is designed to help an organization define its objectives and scope systematically.

There is an emerging trend in new research analyzing multi-cloud structures [4,75,76,77,78] that utilizes multiple cloud services within the same company, thereby reducing dependence on a single provider [64]. However, this shift introduces risk, now a major security challenge [79], especially in the areas of threat detection and management, and multi-clouds have become the target of complex cyber-attacks [64].

3. Navigating the Storm

Organizations achieve easier management, resilience, and escape from vendor lock-in with multi-cloud environments; however, these distributed and heterogeneous systems also create significant security challenges. Resources and identities being distributed across several providers mean an expanded attack surface, exposing the systems to traditional threats like data breaches and Denial-of-Service attacks, as well as contemporary threats such as API exploitation and misconfigurations. The complexity of this scenario requires a multi-cloud protection approach that is more cohesive than that of a single-cloud system, and that includes sophisticated and fully mapped adaptive defences.

This section describes the threat landscape of multiple clouds, including the major classes of attacks and systemic weaknesses arising from the disparate and diverse structural configurations.

3.1. Attacks

A Multi-cloud environment integrates services from multiple cloud providers to achieve greater reliability and flexibility while minimizing the risk of vendor lock-in. Even with widespread usage, over 75% of contemporary businesses utilize a multi-cloud environment [80,81], there is limited research concerning the security, vulnerabilities, and risks associated with a multi-cloud setup [82]. Due to the distributed and varied integration approaches, security becomes challenging owing to the sharing of resources and fragmentation of capabilities. As a result, cloud environment security experts need to apply comprehensive and layered solutions to mitigate sophisticated and intricate threats. Diverse providers of cloud services offer varying security features such as APIs, identity management, network security, and logging, which creates a challenge in integration or interoperability. This often requires the attention of dedicated security personnel who must develop their own proprietary or open-source methods. Moreover, the breach of one virtual machine (VM), when multiple virtual machines share a CPU, storage, or memory, may place others at risk, exposing sensitive information and introducing new vulnerabilities that compromise privacy and data integrity [56,83]. Techniques such as network eavesdropping and session hijacking can allow external hackers to gain unauthorized access. Threats such as Trojan-infested malware, compromised secrets, fractured verification methods, and breaches of confidential information are equally dangerous. Exploited system vulnerabilities, hacked APIs, insider threats, account and service hijacking, including DoS attacks [82,84,85,86] and VM hopping are only a few of the other risks. These issues compound those found in cloud services, such as security in PaaS, risks associated with third-party vendors, and difficulties with the foundational infrastructure. Additionally, unencrypted data, cloning, resource pooling, network challenges, XML signature manipulation, SQL injection [87], and MITM attacks [88] become threats.

Figure 4 attempts to categorize various cloud security threats from high-level risks to specific attacks such as DDoS and VM-Sprawl. It emphasizes vulnerabilities in interfaces, virtualization, data handling, and user behaviour that compromise cloud environments.

In the past several years, cyber-attacks targeting the cloud infrastructure have escalated, resulting in the breach of data containing private documents worth millions and causing financial losses exceeding billions of dollars [91,92,93,94]. In 2009, a major security vulnerability was uncovered within Google Docs—an online SaaS service allowing document editing and sharing—due to this vulnerability, when a document was shared with a user, it was automatically made available to everyone the document owner had ever shared other documents with [95,96]. This vulnerability enabled unauthorized access to confidential data, whether or not they intended to commit a breach of trust. Exploitation of Amazon’s EC2 IaaS service occurs when an attacker persistently instantiates virtual machines until they achieve co-residency with a target on the same physical server. This enables the perpetrator to execute cross-VM side-channel attacks to retrieve or alter information about the victim [96,97]. The signature verification process of Amazon EC2 is susceptible to a signature Wrapping Attack [96,98,99], where an attacker can intercept a valid request, add unauthorized actions to it, and bypass detection [96]. As a result, the malicious operation is executed under the victim’s identity and charged to their account. As illustrated by Uber’s incident in September 2022, gaps in interoperability within multi-cloud environments may result in severe security risks. In this case, an attacker was able to access Uber’s cloud services after finding an admin username and password that had been insecurely stored in PowerShell automation scripts [80].

Cloud security breaches usually stem from customers bestowing unnecessary permissions to users, exposing databases, or simple configuration blunders, rather than problems with the actual system. The assertion made in Ponemon Institute’s Data Breach Report 2019 asserts that system glitches and human errors are the cause of 49% of all breaches [91,100]. Additionally, as forecasted by Gartener, until 2025, 99% of failures in cloud technology will be attributed to failures on the user’s end [91]. While cloud service providers have significantly improved the security of their core systems, the responsibility of securing the upper layers still lies with the customers, leaving them vulnerable. Moreover, even though providers are generally trusted to manage customer data responsibly, there remains a risk of compromise by external attackers [96].

Table 3. Types of Emerging Cyber-attacks in Multi-Cloud Environments [87,101].

Types of Attack	Description
Data Leakage	Unauthorized exposure of sensitive data due to weak access controls, improper data classification, or accidental misconfigurations.
Insider Threat	Security risk originating from within the organization, such as administrators or employees misusing privileged access to compromise systems.
Integrity Issues	Alteration or corruption of data during transmission or storage, which may result in loss of trust, inaccurate analytics, or faulty application behaviour.
API Hacking	Cloud API hacking refers to the unauthorized leveraging of API vulnerabilities to steal data, escalate privileges, disrupt services, or completely compromise cloud infrastructure.
System Vulnerabilities	System vulnerabilities are defined as a flaw in the system’s design, implementation, configuration, or functionality that attackers may use to get unauthorized access, interfere with services, steal or modify sensitive confidential, or breach cloud resource security.
Flooding Attack	A flooding attack is a type of denial-of-service (DoS) attack where an attacker overloads cloud services by over-consuming resources such as bandwidth, processing power, leading to services being overwhelmed with traffic.
XML Signature Attack	An XML Signature Wrapping attack performs elements wrapping, duplication, or relocation in a signed XML structure in such a way that retains the original signature while altering the intended meaning of the message.
Denial of Service attacks	A Denial of Service (DoS) attack saturates the system with an overload of requests, preventing authentic users from accessing and causing system unavailability, sluggishness, or crashes within the cloud environment.
Malicious Attacks	Malicious attacks in cloud leverage malware injection, stealing credentials, insider collusion, or hypervisor exploits to gain unauthorized access, data theft, or service disruption, which compromises confidentiality, integrity, and availability.
MITM Attack	Man-in-the-Middle (MITM) attack in cloud invisibly intercepts and even alters the communications between parties, which may lead to data theft, data alteration, or unauthorized access.

describes different cloud attacks, including data breaches, DoS, and MITM, highlighting their impact on system confidentiality and availability. It shows how attackers exploit flaws in APIs, user privileges, and infrastructure to disrupt or gain unauthorized access.

The fundamental risks in multi-cloud systems are similar to those in single-cloud setups; multi-cloud environments introduce an expanded attack surface, increased complexity in security architecture, and different mitigation priorities. Most of the existing literature is based on either single cloud providers or on independent providers, which overlooks the consolidated problems that are particular to multi-cloud environments.

In general, the taxonomy demonstrates that, due to the interconnection of multiple clouds, multi-cloud attacks emerge from both well-established cloud exploitation methods and new avenues for exploitation, such as emerging financially motivated or infrastructure-level threats. While individual cloud platforms exhibit similar vulnerabilities, their integration amplifies the propagation of risk and complicates detection and response. This dual nature of the danger emphasizes the need to adopt structural defences, considering the adaptability and operational interdependence of the multi-cloud architecture.

3.2. Financial Abuse and Infrastructure Weaponization in Multi-Cloud Environments

Beyond breaches of confidentiality and data integrity, recent years have witnessed a significant rise in financially motivated exploitation and infrastructure-level exploitation within multi-cloud environments. These emerging threats attempt to inflict economic damage and operational disruption without directly compromising data, leveraging the cloud’s elasticity, shared resources, and pay-per-use features of multi-cloud.

Financial abuse within multi-cloud environments demonstrates a shift from data-centric breaches to economically driven exploitation. Adversaries exploit elasticity and pay-as-you-go pricing structures through cryptojacking and billing fraud to generate direct or indirect profit. Cryptojacking refers to the unauthorized use of cloud computing resources to mine cryptocurrencies. Adversaries infiltrate virtual machines, containers, or serverless instances—often through leaked credentials, misconfigured APIs, and deploy mining scripts that run continuously in the background [102]. Since cloud billing systems are directly tied to the utilization of CPUs and GPUs, even a small-scale cryptojacking operation could result in significant financial damage for customers. Recent analyses reveal a shift of cryptojacking operations from end-user devices to cloud and multi-cloud infrastructures, capitalizing on abundant compute resources and weak configuration management [103]. Tekiner et al. (2023) reported that modern cryptojacking and malware ecosystems increasingly rely on multi-cloud deployments to establish resilient C2 infrastructures [104]. Attackers distribute lightweight controller instances across several cloud providers to enhance fault tolerance and evade provider-specific detection mechanisms. This multi-tenant dispersal enables dynamic reconfiguration of control pathways, rendering conventional IP-based blacklisting ineffective. Caprolu et al. (2019) presented a comprehensive network-traffic-based detection model capable of distinguishing mining activity in cloud workloads with high accuracy [102]. Such evidence underscores that financial sustainability has become an integral element of multi-cloud resilience.

Financially motivated exploitation, particularly in the form of Economic Denial of Sustainability (EDoS) and fraudulent resource consumption, has become a critical dimension of cloud security. Unlike cryptojacking, where attackers profit directly from stolen compute power, billing fraud and EDoS attacks target the victim’s financial sustainability by artificially inflating resource consumption or inducing excessive auto-scaling. Attackers achieve this by repeatedly invoking cloud APIs, triggering automatic provisioning, or generating large volumes of seemingly legitimate traffic. Somani et al. (2017) conceptualized EDoS as a variant of Distributed Denial-of-Service (DDoS) that exploits the economic model of clouds rather than relying solely on bandwidth saturation [105]. More recent work by Dorsett et al. (2025) analyzed denial-of-wallet threats in Function-as-a-Service (FaaS) and container-orchestrated architectures, observing that attackers can trigger cascading scaling events across multi-provider systems, thereby amplifying operational cost and destabilizing billing predictability [106]. Karami et al. (2016) empirically demonstrated that prolonged low-intensity traffic in cloud systems can induce automatic scaling and substantial billing losses for targeted tenants [107]. Similarly, simulation-based research confirms that these attacks differ fundamentally from conventional denial-of-service incidents, as they remain persistent, yet stealthy, degrading service quality while evading rate-based detection thresholds [108]. A documented case study reported that a controlled EDoS experiment resulted in a 300% increase in billing costs for a cloud tenant over a single billing cycle [109]. Aldhyani and Alkahtani (2022) designed an AI-based EDoS detector that evaluates classic ML (SVM, KNN, Random Forest) and DL (CNN, LSTM) models on multi-class attack data, reporting high classification performance and low error [110].

The cloud infrastructure weaponization illustrates how attacks have shifted from targeting the cloud to utilizing the cloud as an attack vector. In multi-cloud environments, adversaries leverage elasticity, redundancy, and dispersed presence to amplify attacks and distributed presence to scale attacks, mask origins, and maintain persistence. Repurposing compromised cloud resources enables the initiation of large-scale DDoS attacks and command and control over DDoS infrastructure while transforming legitimate cloud services into attack platforms. The elasticity and shared infrastructure of public cloud servers are currently being leveraged to amplify DDoS attacks and to stage botnets. Frieß et al. (2024) exposed real-world incidents in which attackers hijacked dangling DNS entries and orphaned resources within major cloud platforms to host malware and act as C2 proxies [111]. By reclaiming abandoned infrastructure components, adversaries created covert control nodes that blended seamlessly into trusted network spaces. This mode of weaponization underscores that even decommissioned or mismanaged assets can be repurposed as vectors for persistent command and control (C2) operations. Such threats can be mitigated through unified cross-provider monitoring, strict egress traffic analytics, and resource lifecycle governance so that cloud systems remain defensive and not part of offensive cyber-attack infrastructures.

Collectively, all these developments illustrate that the contemporary multi-cloud threat landscape goes beyond the conventional risks associated with data and includes the economic exploitation of resources and the weaponization of infrastructure. Acknowledging and incorporating these vectors within a threat taxonomy will provide a more comprehensive understanding of adversary motivations and strengthen the foundation for designing responsive and behaviorally driven, cost-efficient defence strategies in multi-cloud environments.

3.3. Emerging Threats and Vulnerabilities

Cloud computing’s rapid expansion has created a constantly shifting threat landscape that outpaced traditional security frameworks, exposing new vulnerabilities [5]. At the same time, the overwhelming use of multi-cloud infrastructures, where businesses distribute workloads across multiple providers, has outstripped research into specific security risks and vulnerabilities of such systems [82]. Around 88% of cloud security breaches have been shown to result from cybercriminals exploiting misconfigurations, such as unprotected storage buckets or inadequate access controls, which highlights the necessity for improved training and adherence to security practices (Non-peer-reviewed source [112,113]). In summary, the rapid increase in cloud adoption has transformed IT frameworks, created new user communities and market opportunities while highlighting the urgent need for updated security approaches specific to these systems [114,115].

Multi-cloud environments share similar security risks with single-cloud setups, such as common attack vectors, but these risks are intensified by the complexity of managing multiple providers [82,116]. The increasing adoption of technology among a broader range of users creates new vulnerabilities for organizations as they work to ensure robust security. Apart from defending against technical threats, multi-cloud security involves adhering to a myriad of privacy and data governance laws. As data protection becomes more critical, countries worldwide have passed regulations that specify how data must be stored, processed, and shared. One leading example is the EU’s General Data Protection Regulation (GDPR), which imposes strict requirements for any business that collects, processes, or deals with personal information of individuals residing in or associated with the European Union [82,117,118].

As organizations increasingly adopt multi-cloud models, nearly 70% by 2019, they face a complex security attack surface, increased vulnerability, and complicated security frameworks [82,92,119]. The healthcare sector filed more insurance claims related to ransomware attacks than any other economic sector from 2015 to 2019, because of breaches not only compromising sensitive medical information but also significantly increasing access risks during critical phases such as diagnosis, treatment, and transport [84,120,121]. Moreover, research has shown that breaches of data privacy may lead to clinical consequences, as in one study where breaches were linked with higher 30-day mortality rates in hospitals [84,121,122]. In 2019, over 100 million customer accounts were compromised due to a sophisticated data breach at Capital One, which stemmed from a misconfigured web application firewall that was exploited by an attacker [5,113]. During the SolarWinds breach in 2020, attackers exploited software update mechanisms used to infiltrate and gain unauthorized access to cloud networks worldwide [5,123].

Table 4. Studies focused on Threat, Intrusion and Anomaly detection.

Ref.	Year	Types of Detection	Detection Mechanism	Tool/Framework Used	Environment	Dataset	Data Classification
[124]	2025	Threat Detection	AI-Driven SIEM	N/A	Multi-Cloud	N/A	✓
[121]	2025	Anomaly Detection	SSAE with CHDLCY	Combined Hybrid Deep Learning Framework	Multi-Cloud	✓ (BOT-IoT, NSL-KDD)	✓
[125]	2024	Intrusion Detection	DFCCNN-BWOA-IDC	MATLAB	N/A	✓ (DARPA)	✓
[126]	2024	Intrusion Detection	1D-CNN-based IDS	N/A	Multi-Cloud	✓ (UNSW-NB15)	✓
[127]	2024	Anomaly Detection	Cluster-Based Local Outlier Factor (CBLOF), GraphSAGE	NetworkX, Neo4j	N/A	N/A	✓
[91]	2023	Threat Detection	CSBAuditor	N/A	Multi-Cloud	N/A	✓
[128]	2023	Intrusion Detection	Hybrid Deep Learning and optimization techniques	N/A	N/A	✓ (KDDCup-99, NSL-KDD, BoT-IoT, CICIDS-2017)	✓
[129]	2023	Intrusion Detection	DNN, MLP-BP, MLP-PSO	N/A	N/A	✓ (CSE-CIC-IDS2018)	✓
[130]	2023	Intrusion Detection	Random Forest (RF), RBFNN	N/A	N/A	✓ (Bot-IoT, NSL-KDD)	✓
[131]	2023	Intrusion Detection	Hybrid Deep Learning techniques	N/A	N/A	✓ (CICIDS 2018, SDN)	✓
[132]	2023	Intrusion Detection	MFE-ELM algorithm	N/A	N/A	✓ (NSL-KDD)	✓
[133]	2023	Intrusion Detection	I-GN, OBL-RIO, 2D-ACNN	N/A	Multi-Cloud	✓ (NF-UQ-NIDS)	✓
[84]	2022	Anomaly Detection	MUSE	TensorFlow, Keras	Multi-Cloud	✓ (BOT-IoT, UNSW-NB15)	✓
[62]	2022	Intrusion Detection	Honeypots	Snort	Multi-Cloud	✓ (KDD12)	✓
[134]	2022	Anomaly Detection	Ensemble Machine Learning (EML), CNN-LSTM	N/A	N/A	✓ (UNSW-NB15)	✓
[135]	2022	Intrusion Detection	Hybrid Machine Learning techniques	N/A	N/A	✓ (NSL-KDD, KDDCup99)	✓
[136]	2019	Intrusion Detection	Stacked Denoising Autoencoder-based IDS (SDAE-IDS)	GPU-enabled TensorFlow	Multi-Cloud	✓	✓
[85]	2017	Anomaly Detection	Supervised ML (Random Forest, Linear Regression)	N/A	Multi-Cloud	✓ (UNSW)	✓

Note: ✓ indicates that the attribute is considered in the corresponding paper, whereas N/A denotes that the attribute is either not applicable or not reported.

attempts to summarize research on cloud-based threat, intrusion, and anomaly detection, describing different types of methods. It highlights tools, datasets, and classification usage across multi-cloud environments. All numerical performance metrics are reported exactly as stated in the original studies. Datasets and evaluation contexts vary across works. Therefore, the values are not directly comparable.

A comprehensive approach to cloud security must include ongoing identification and management of vulnerabilities and threats created by insider risks, external attackers, malware, or hardware failures across rapidly evolving, distributed environments. As information and workloads are distributed across multiple servers, locations, and delivery models such as IaaS, PaaS, and SaaS, keeping permissions and access controls updated is critical, yet highly challenging and extremely mandatory [137]. In such a dynamic cloud infrastructure, by plotting possible exposures, interaction risks, and service interruptions against the trade-off of each cloud service model’s confidentiality, integrity, and availability (CIA), organizations can determine the most applicable threats requiring bespoke defences while ensuring access control is maintained to sensitive information infrastructure resources and the risk is mitigated [138].

Table 5. Core principles of information security—confidentiality, integrity, and availability [138].

Threats to Confidentiality
Insider User Threats	The risk is escalated as internal users, such as administrators, developers, and consultants across SaaS, PaaS, and IaaS models, can access the customer data.
External Attacker Threats	When possessing sensitive or valuable data, all cloud models are vulnerable to external attacks, such as social engineering, supply chain attacks, and even hardware manipulation.
Data Leakage	Data breaches between organizations sharing the same cloud service provider might occur due to human error or defective machinery.
Threats to Integrity
Data Segregation	Data integrity may be compromised through improper segregation in shared environments, including SaaS services.
User Access	Inadequate controls over access, especially involving former employees, can lead to intentional data damage.
Data Quality	Data integrity can be affected for other users sharing the same infrastructure due to a misconfiguration or fault in the components by a single user.
Threats to Availability
Change Management	Poorly managed changes by providers can disrupt service availability.
Denial of Service	DoS attacks, both internal and external, can affect any cloud model.
Physical Disruption	Less secure user environments are more vulnerable to physical disruptions.
Weak Recovery Procedures	Inadequate or untested disaster recovery plans can lead to prolonged outages.

outlines the major threats to the confidentiality, integrity, and availability of cloud services, detailing each threat’s implications for the security and stability of cloud services.

In summary, after analyzing the various threats, it is clear that multi-cloud ecosystems inherit the full spectrum of traditional cloud vulnerabilities while simultaneously introducing additional risks arising from interoperability and dispersed control. These observations reinforce the case for unified approaches that give priority to identity assurance, precise configuration management, and secure data handling across all participating cloud platforms.

4. Comparative Study

As cloud computing has matured, both researchers and industry practitioners have increasingly adopted multi-cloud approaches, which have advanced over time. In particular, recent studies have focused on the infrastructural challenges of integrating and orchestrating resources across several clouds, where resource federation and unified management seem to be the most vibrant areas of research [27]. Security remains the most prominent barrier impeding the adoption of cloud services, while multi-cloud approaches add further complexities to protection; they also provide new opportunities to enhance control over data and services while upholding confidentiality, integrity, and availability. Implementing a multi-cloud approach enhances data confidentiality by distributing information across multiple providers, which improves confidentiality while addressing significant storage challenges, such as outages, data corruption, privacy violations, and vendor lock-in [24,139]. Different types of security measures have been formulated to address the vulnerabilities and strengthen the overall protection for data, ensuring reliable privacy during data provision and storage in a resilient manner.

Table 6. Comparative analysis of related works.

Ref.	Year	Objective of Research	Security/Privacy Mechanism	Data Integrity	Strength	Limitation
[56]	2024	Data Security and Governance	N/A	✓	Governance & security integration, Multi-tool comparison. Accuracy: Not reported in the original study	Limited to experimental/simulated attacks, No quantifiable evaluation, No long-term deployment
[1]	2023	Secure big data using hybrid encryption	Feistel network and AES with S-box	✓	Complete security framework, Strong comparative performance. Accuracy: Not reported in the original study	No integrity verification, Limited scalability tested, Access control not explored
[140]	2021	Enhance Trust	Zero Trust Security Model(Istio)	✗	Novel cross-cloud setup, Multi-metric monitoring. Accuracy: Not reported in the original study	Limited test scenarios, Hardware imbalance
[27]	2021	Enhance security and privacy	DepSky Model, BFT, Shamir Secret Sharing	✓	QoS-aware authentication, Real multi-metric benchmarking. Accuracy (as reported): 29.19% (dataset not described)	Simulation-Only Evaluation, Limited Scope
[141]	2021	Enhance performance and security for resource allocation	Portunes Algebra, OnTimeURB, SRAA	✓	Joint performance/security optimization, Validated OnTimeURB framework. Accuracy: Not reported in the original study	Approximate Optimization, Limited Evaluation
[79]	2020	Improve authentication and data integrity	RSA Encryption, Hashing Algorithm	✓	Integrated triple-layer defence, Real-world deployment feasibility. Accuracy (as reported): 90–92% (dataset not described)	Simulation-Only, Scalability Untested, Heavy RSA Dependency
[142]	2019	Builds and tracks trust	Blockchain	✓	Dual trust evaluation (direct + indirect), Blockchain audit. Accuracy (as reported): 85–90% (dataset not described)	Simulated Evaluation, Performance Overhead
[143]	2019	Sirius system implementation	Secure embedding, Isolation	✗	First secure, open-source network virtualization platform. Accuracy: Not reported in the original study	Network control dependency, Nested VM impact
[144]	2018	Minimize cost	Bi-objective genetic optimization	✗	Advanced Mean Failure Cost, Sustainable decision-making. Accuracy: Not reported in the original study	Ignored inter-cloud costs, Static risk estimation
[145]	2017	Enhanced Security for data sharing	Data Slicing, Encryption	✗	No third-party trust dependency, Resistance to insider attacks. Accuracy (as reported): ~90% (dataset not described)	Key management issues, Fixed provider count
[33]	2016	Secure gateway system	Hybrid Secret Sharing	✓	Multi-layer cryptographic design, Resistance to insider attacks. Accuracy: Not reported in the original study	Trust Assumptions, Limited Scalability
[146]	2016	Increase Trust	Enhanced Mutual Trusted Access Control Algorithm, Behaviour-based Trust Model	✗	Evaluates user and provider trust, Ensures malicious access prevention. Accuracy: Not reported in the original study	Simulation-only, Uncertainty
[69]	2015	Increase Data Security	Shamir’s Secret Sharing	✓	Confidentiality, Integrity, Availability (CIA) through data splitting. Accuracy: Not reported in the original study	No validation or performance evaluation
[147]	2015	Enhance confidentiality and integrity	Auth, Encryption, Segmentation	✗	Integrity & confidentiality in one model, High reliability and reduced leakage. Accuracy: Not reported in the original study	No evaluation, Admin trust assumed
[148]	2015	Increase Trust	Trust Propagation Network	✗	Dual-layer trust model, Robust propagation network. Accuracy (as reported): 90% (dataset not described)	Simulation-only, No real integrity/privacy
[149]	2015	Increase Data Privacy	Asymmetric & Ciphertext-Policy Attribute-Based Encryption, Hash functions, Digital signatures	✓	Fine-grained access control, Dual authentication, Data verification. Accuracy: Not reported in the original study	Computational Overhead, Lack of Implementation & Performance Evaluation
[45]	2014	Increase Trust	Dynamic Trust-Based Access Control (DTBAC), Multi-Factor Authentication	✗	Multi-layered access control architecture that evaluates real-time trust evidence. Accuracy: Not reported in the original study	Simulation-only evaluation, Synthetic data, Lack of explicit privacy/integrity protocols
[150]	2014	Cross-Layer Monitoring	VM isolation, Simple Network Management Protocol	✗	Cross-layer visibility, High performance stability. Accuracy (as reported): 99% (dataset not described)	Proof-of-concept stage, Evaluated in limited multi-cloud scenarios
[151]	2013	Increase Data Privacy	Symmetric & Asymmetric Encryption, Chinese Remainder Theorem-Based Secret Sharing, Digital signatures	✓	Client-controlled, Data-centric security model. Accuracy: Not reported in the original study	No Secure Search, Computational Overhead Tuning, Implementation Considerations
[152]	2013	Privacy in service composition	K-means	✗	Privacy-preserving design, Computational efficiency. Accuracy (as reported): 99% (dataset not described)	Simulation-only evaluation, Sequential service model

Note: ✓ indicates that the attribute is considered in the corresponding paper, whereas N/A denotes that the attribute is either not applicable or not reported.

provides a comparative overview of multi-cloud security research, highlighting each study’s objectives, applied mechanisms, data integrity considerations, and key limitations. All numerical performance metrics are reported exactly as stated in the original studies. Datasets and evaluation contexts vary across works. Therefore, the values are not directly comparable. The performance metrics reported across prior studies use heterogeneous datasets and evaluation protocols. Thus, the values in Table 6 are reproduced exactly as stated in the original papers and are not intended for direct numerical comparison. When a study did not provide a specific metric, this is noted as ‘Not reported in the original study’.

4.1. Literature Search Description and Selection

To maintain the transparency of the construction of comparative tables, we applied a structured, non-systematic search approach consistent with a comprehensive narrative literature review. Relevant studies related to multi-cloud security, IAM, provenance, and SLA or cost-aware orchestration were identified across the scholarly sources, including IEEE Xplore, ACM Digital Library, SpringerLink, Elsevier, ScienceDirect, Google Scholar, MDPI, and arXiv.

4.2. Search Scope

The search covered publications from 2009 to 2025, reflecting the period during which multi-cloud architectures, data security models, and defence mechanisms matured.

4.3. Search Keywords

“multi-cloud security”, “multi-cloud architecture”, “cross-cloud identity management”, “multi-cloud provenance”, “multi-cloud orchestration”, “cloud cost optimization”, “multi-cloud data security”.

4.4. Inclusion Basis

Studies were included if they met the following conditions:

• Addressed multi-cloud architectures.
• Examined at least one of the core domains in this review, such as security, IAM, provenance, or orchestration.
• Provided conceptual, architectural, empirical, or technical contributions relevant to multi-cloud environments.

4.5. Exclusion Basis

• Works limited to single-cloud scenarios.
• Non-technical opinion articles or introductory cloud overviews.
• Duplicated content between preprints and published versions.

With the increasing reliance on multi-cloud environments for distributed data processing and storage, securing inter-cloud interactions has become a central research focus. Foundational security techniques such as AES, RSA, and hybrid encryption mechanisms (e.g., Feistel-AES) [1,33], have been widely adopted to ensure data confidentiality and secure transmission, often paired with segmentation and indexing strategies [145,147] to minimize exposure risks. To enhance resiliency and mitigate single-point failures, secret sharing schemes such as Shamir’s algorithm [69] and Byzantine fault tolerance (BFT) [27] have been integrated into hybrid architectures to achieve secure, redundant storage across diverse clouds. Recognizing that encryption alone is insufficient, the research progressed toward incorporating dynamic and behaviour-based access control models, as demonstrated in works proposing subjective-objective trust mechanisms [148], enhanced mutual trust algorithms [144], and reputation-driven models [45,142]. These models offer real-time adaptation to user behaviour and cloud reputation, addressing gaps in static role-based models. Further sophistication was introduced through attribute-based encryption (ABE) and digital signature integration [149,151], enabling fine-grained authorization while preserving policy confidentiality. Addressing inter-cloud trust and orchestration, federated brokers and middleware layers have been designed [141,152], often leveraging zero-trust principles and service meshes for secure microservice-level interaction [140]. Parallel to this, monitoring-as-a-service solutions such as CLAMS [150] provided visibility across SaaS, PaaS, and IaaS layers, ensuring SLA enforcement and anomaly detection. In healthcare scenarios, secure visualization and anonymized data access emerged as critical, leading to privacy-preserving multi-cloud models tailored for 3D data and patient-centric workflows [143,145,151]. Blockchain-based trust enforcement [142] and access brokers further addressed the need for transparent, immutable activity logging. Despite these advancements, challenges persist, especially in areas of unified IAM, policy synchronization, and real-world adversarial resilience, as highlighted in governance-centric studies [56] and authentication-focused works [79]. These findings collectively underscore a progressive research trajectory from cryptographic foundations to intelligent, policy-aware, and interoperable multi-cloud security frameworks, essential for scalable and trustworthy digital ecosystems.

While different clouds can help organizations avoid vendor lock-in and enhance redundancy, the disparate specialized services utilized can result in a fragmented and inefficient cost structure. Consequently, optimizing costs is essential to control over provisioning, dormant resources, and erratic invoicing, all of which negatively impact ROI. Due to factors such as varying pricing strategies, inaccessibility to proprietary billing information, and constant shifts in pricing frameworks, optimizing costs in multi-cloud environments has received little attention in the scholarly literature, which is quite unfortunate considering its importance. As a result, most research focuses on issues such as security, performance, and interoperability while neglecting cost optimization, which remains a critical and underexplored domain.

Table 7. Summary of multi-cloud cost optimization algorithms and their limitations.

Ref.	Year	Factor Considered	Algorithm	Strength	Limitations
[153]	2023	Minimizes monetary cost	Multi-Objective Particle Swarm Optimization (MOPSO)	Outperforms existing methods with better reliability, cost savings, and faster execution.	Excludes indirect cost, human error modelling, and relies on simulated scenarios.
[154]	2022	reduce execution cost	Fault-tolerant Cost-efficient Workflow Scheduling Algorithm (FCWS)	Reduces execution time and cost, improves reliability, and outperforms existing methods across diverse billing models and cloud platforms.	Fixed reliability evaluation method, No consideration of other cost factors, such as communication cost tiers or spot pricing discounts.
[155]	2021	Minimize monetary cost and response time	Query Graph Generation, Agent-Based Dynamic Execution	Reduce data transfers, improving accuracy, and ensuring more efficient and cost-effective query processing.	Inaccurate cost estimation, No strong SLA guarantees, only trust-based, focused only on relational models.
[156]	2020	Minimize total data management cost	NSGA-II based approach	Achieves better efficiency and adaptability, Leveraging real-world cloud data and supporting dynamic access.	Does not address data migration under changing DAF, Availability values are simulated, No support for other SLAs such as latency.
[157]	2019	Minimize total cost	Workflow Mapping, AllocateVT, ChooseBT	Minimizes financial cost by efficiently managing both computation and communication resources across diverse workflow scenarios.	Assumes fixed VM or bandwidth availability, Uses synthetic workflow generation, Does not account for cloud faults or SLA violations.
[158]	2019	Minimize storage costs	Random Linear Network Coding (RLNC)	Outperforms traditional redundancy methods by efficiently regenerating data during cloud interruptions.	Focuses only on storage, assumes fog nodes can always access data, and has Limited real-world trace data.
[159]	2018	Minimize total cost	GetBR, SelectCSP, GetBRA	Adaptive storage mode selection, Achieves cost savings, High availability and flexibility	Focuses only on availability and cost, Ignores security and latency.
[160]	2018	minimize executing cost	Integer Linear Programming (ILP)	Outperforms existing methods by offering flexible deadline handling, and strong performance in real-world multi-cloud scenarios.	Less Scalable, assumes static scheduling, which is not suitable for real-time dynamic environments.
[161]	2015	Minimize monetary cost	Heuristic Data-Placement, Storage-Mode Transition	Improves efficiency, reduces expenses, and adapts to changing workloads while avoiding vendor lock-in.	Uses simplified predictor for access frequency, assuming trust in SLAs for availability, Limited to file-level decision granularity, not block-level.
[162]	2015	Minimize total cost	Centralized optimization	Improves scalability, supports time and budget constraints, and adapts to dynamic cloud conditions using realistic pricing models.	Centralized model lacks scalability, Decentralized model has not yet been implemented, No real-world deployment validation.
[163]	2012	Minimize total cost	0–1 Integer Programming Model	Adapting price changes, enabling partial reallocation, and considering real-world constraints.	No integration with real-time cloud APIs, assumes static workload for evaluation.
[164]	2013	Minimize total infrastructure cost	Improved Greedy Algorithm	Improves resource efficiency using real-world workload data.	Assumes static QoS matrix, Dynamic VM types, and real-time failures not considered.
[165]	2013	Minimize deployment cost	Genetic Algorithm (GA), Mixed-Integer Programming (MIP)	Offers flexible, cost-effective placement and outperforms traditional solvers on large, real-world multi-cloud scenarios.	No support for dynamic workload evolution; assumes fixed resource specs and static demand, Storage or bandwidth pricing not modelled.
[166]	2011	Minimize total storage cost	Linear Programming Model (LP-Assignment)	Optimizes storage based on cost and quality of service, Privacy-preserving multi-cloud storage.	Ignores real-time failures and latency, security relies on non-collusion beyond threshold, simulated deployment.
[167]	2011	Minimize infrastructure cost	Integer Linear Programming (ILP)	Adapts real-time pricing, ensuring minimal performance impact through controlled, User-transparent reconfiguration.	Limited to short-term predictions, ignores migration cost and network latency, and is tested on a limited scale.
[168]	2011	minimizes cost, and balances resource	Genetic Algorithm (GA)	Outperforms traditional methods, improving efficiency, and adapting to varying workload demands.	No deallocation strategy included, no real-time cloud API integration or real use of provider data.

Note: The term “cost” refers to cumulative expenses, including computational, storage, data transfer, and reliability-related costs incurred in multi-cloud orchestration.

presents a summary of multi-cloud cost optimization algorithms, outlining their objectives, methods, descriptions, and the limitations associated with each approach.

In recent years, the challenge of jointly optimizing cost and availability in multi-cloud environments has driven a significant evolution in scheduling and data placement methodologies. Initial research focused on centralized formulations, such as ILP-based models for workflow mapping [157,160] and service placement [165], offering optimal cost solutions under deadline and resource constraints. However, the rigidity and computational overhead of these approaches limited their applicability in dynamic, real-world clouds. This led to the adoption of lightweight heuristics, such as the dynamic storage selector in CHARM [161] and greedy schedulers balancing cost-availability trade-offs [164], which improved scalability and responsiveness. Yet, these models often failed to manage trade-offs effectively when faced with multiple conflicting objectives. To address this, researchers introduced multi-objective metaheuristics, including ACO [159], and NSGA-II [156], which generate Pareto-optimal fronts for cost and availability, often enhanced by entropy-based or adaptive selection mechanisms. Simultaneously, genetic algorithms proved effective in resource provisioning and component placement [165,168], particularly for long-running and latency-sensitive applications. As models matured, emphasis expanded to security and redundancy, with LP-based threshold models [166] and network coding techniques such as MSR and MBR [158] offering cost-resilient solutions under failure or spot instance volatility. Moreover, to scale with Internet-scale demands, research transitioned toward decentralized and predictive scheduling, where agent-based approaches [156,167] and trend-based reallocation models [164] adapted dynamically to cloud pricing and workload patterns. Collectively, these existing works depict a maturing field that has shifted from static, cost-centric optimization to adaptive, secure, and availability-aware orchestration frameworks, better aligned with the heterogeneity and volatility of real-world multi-cloud environments.

Despite their progress, recurring limitations persist. Most models assume static task execution times and provider prices, limited support for real-time reallocation or correlated failures, and overreliance on simulation-based validation. Future research must thus address these gaps through robust, real-world adaptive frameworks that can integrate predictive analytics, dynamic pricing, and reliability-aware deployment into unified, end-to-end multi-cloud orchestration solutions.

5. Security Challenges in Multi-Cloud

Organizations using multi-cloud setups often face unique security risks due to the fragmented nature of cloud platforms [4,56]. Each provider comes with its own tools, policies, and architectures, which makes it harder to maintain consistent security rules across the entire environment [56,169]. Without unified governance, sensitive data may be classified differently or left unprotected during transfers [169]. Key management becomes risky when encryption keys are handled differently across providers, as a single forgotten key can lead to full compromise [170]. Visibility is another concern, since monitoring is not centralized, threats in one cloud may remain undetected [143,171]. Also, IAM complexity increases, with orphaned accounts and inconsistent roles becoming a serious threat [4,56]. Shared responsibility is often misunderstood, leading to gaps where no one enforces cross-cloud API protection [96]. Compliance becomes a nightmare as audit logs get scattered and laws vary between data centers [169,170]. This inconsistency can allow attackers to pivot laterally between clouds using exposed APIs or weak access paths [96,171]. All these factors prove that security consistency and unified control are essential in multi-cloud environments [143].

Table 8. Common Security Challenges in Multi-Cloud Environments.

Security Challenges	Nature of the Challenge	Practical Significance
Policy Alignment	Different providers use distinct policy languages and models [4,96]	Misaligned rules left cloud storage buckets publicly exposed
Security Feature Diversity	Threat detection and protection tools vary across clouds [56,143]	Malware slipped past clouds lacking EDR or advanced threat analysis
Data Classification Gaps	Sensitivity tags don’t sync between clouds [56,169]	Sensitive data was left unencrypted in one cloud due to misclassification
Key Management Complexity	Separate key storage for each cloud makes coordination harder [56,170]	Abandoned encryption keys were later exploited after offboarding failures
Compliance & Audit Trouble	Logs and events are stored in silos, hard to correlate [169,170]	Compliance audits delayed due to scattered cloud event records
Trust Boundaries Blur	Confusion around which provider is responsible for what [96]	Cross-cloud API traffic went unencrypted and unaudited
IAM Fragmentation	IAM tools differ, leading to outdated or unused access controls [4,170]	Former employee’s credentials remained active in a secondary cloud
Visibility Gaps	No single SIEM platform can oversee all clouds well [143,171]	A breach in one cloud remained invisible to the organization for days
Expanded Attack Surface	More clouds are equal to more APIs, endpoints, identities to defend [4,96,171]	Attackers exploited exposed APIs to move laterally between cloud zones
Vendor Lock-In Risks	Lack of portability make migrating workloads harder, increasing dependency [170,171]	Critical apps couldn’t be moved quickly during a provider’s outage, impacting business continuity

summarizes major cloud security challenges, detailing their causes and practical effects, and demonstrates how misconfigurations, fragmented controls, and limited visibility can compromise cloud security and resilience.

In conclusion, the identified challenges reveal that policies failing to address the challenges of fragmentation, inconsistency of IAM, and complexity of key management are not only isolated obstacles but also interconnected challenges that increase exposure to risk across providers. While most studies emphasize the issues of misconfiguration and visibility gaps, fewer studies address the compounded issues of cross-cloud compliance and governance misalignment. This synthesis suggests that to achieve consistent security across multi-cloud ecosystems, there must be a convergence of both technical and organizational controls, particularly unified policy frameworks and comprehensive observability solutions that reach across provider boundaries.

6. Solutions and Frameworks for Securing Multi-Cloud

Navigating security challenges across multiple cloud platforms is inherently difficult; considerable progress has been made in developing robust mitigation strategies. Cryptographic techniques such as secret sharing and homomorphic encryption are often used to protect sensitive data, even when it’s stored or shared across multiple providers [96,170]. These methods ensure that the data stays secure even if part of the system is compromised. Another technique is Machine learning, which is helping security systems become more responsive. It can detect unusual patterns or risky behaviours by analyzing large volumes of cloud activity [56,171]. In some systems, AI is also used to make access decisions or alert teams without human input, which saves time and reduces errors [171]. In cases where the data is unclear or incomplete, fuzzy logic is useful. It provides systems with a way to reason through uncertainty, a common occurrence when different clouds handle information in other ways [171]. Another key tool is Identity and Access Management (IAM). When IAM is centralized, it helps apply the same access policies across clouds, which lowers the chance of mistakes or forgotten user accounts [4,56]. Some research also recommends using tools such as policy-as-code, automated infrastructure setups, and orchestration frameworks to maintain security controls uniform across all platforms [143,170]. These combined solutions provide organizations with better awareness and control, making their overall system more secure. Although no approach is perfect on its own, combining these methods creates a more flexible, stronger, and forward-thinking security strategy for modern cloud environments [96,143,170].

6.1. Cryptographic Techniques for Multi-Cloud Security

Cryptographic techniques are methods used to secure data and communication by transforming plain information into an unreadable form known as ciphertext. These encrypted forms can only be decrypted by authorized parties [69,172]. These techniques are indispensable for upholding the core principles of information security: confidentiality, integrity, and authenticity [172,173]. In multi-cloud environments where data flows across different providers and is stored in varied, often externally managed locations, cryptography becomes important. It safeguards information as it moves or resides across platforms, ensuring protection against unauthorized access, tampering and data leaks [1,69,174]. For example, encrypting data before it exits an organization ensures that cloud providers only handle encrypted forms, reducing the chances of internal abuse or breaches [1]. Overall, modern multi-cloud security heavily relies on cryptography to ensure secure access, data confidentiality, and cross-cloud compliance, allowing organizations to use cloud flexibility without exposing sensitive assets [1,172,174].

Table 9. Cryptographic Techniques in Multi-Cloud Environments.

Cryptographic Technique	Explanation	Primary Advantage
Shamir’s Secret Sharing [69]	Splits secret into n parts, reconstructable only with k or more	Ensures confidentiality and availability by distributing fragments across clouds
Hybrid Encryption (AES+RSA) [174]	AES encrypts data, RSA encrypts AES key	Ensures layered encryption: fast processing with AES and secure key distribution using RSA
Blockchain + Hybrid Crypto [174]	Combines AES+RSA with blockchain smart contracts and immutable logs	Enables decentralized access control and tamper-proof traceability of storage actions
Homomorphic Encryption [175]	Supports computation directly on encrypted data without decryption	Preserves data privacy during analytics and ML tasks across untrusted clouds
Feistel, AES Framework [1]	Feistel-generated keys are used to drive AES encryption rounds over big data slices	Improves encryption speed and randomness; strong avalanche effect across cloud storage
Attribute-Based Encryption [172]	Access control tied to attribute policies; only users matching policy can decrypt	Enables fine-grained access control in collaborative multi-cloud environments
Identity-Based Encryption [172]	Public key is generated from the user’s identity, simplifying distribution	Eases key management across multi-cloud setups

summarizes cryptographic techniques used in multi-cloud environments, explaining their working principles and highlighting their primary security and performance advantages.

After analyzing various cryptographic approaches, it seems that hybrid encryption, along with secret sharing models, achieves an optimal balance between computational efficiency and confidentiality across distribution. On the contrary, homomorphic and attribute-based encryption approaches offer an improved level of privacy, albeit at a significantly higher computational expense. Blockchain-assisted encryption provides new opportunities for integrating auditability; however, challenges persist regarding scalability. Overall, most recent research in cryptography focused on multi-clouds is transitioning from static encryption to adaptive encryption, utilizing policy-based approaches that embed key management systems and trust enforcement in orchestration layers.

6.2. AI Techniques for Multi-Cloud Security

Artificial Intelligence (AI) techniques have become a cornerstone in strengthening multi-cloud security due to their ability to detect and respond to complex cyber threats in real time. Traditional rule-based systems fail to handle dynamic, large-scale environments, but AI bridges this gap by offering adaptive, intelligent defence mechanisms [176]. Machine learning models such as Random Forest and Gradient Boosting can classify threats effectively. In contrast, deep learning architectures such as LSTM can detect abnormal behaviours by analyzing time-series patterns across diverse cloud infrastructures [177]. Moreover, the integration of reinforcement learning allows cloud systems to update security policies autonomously based on evolving risks, reducing both false positives and mitigation time [177]. Federated learning is another powerful approach that supports privacy-preserving detection without transferring raw logs across cloud platforms, which is vital for regulatory compliance in sensitive sectors such as finance and healthcare [178,179]. To further enhance detection precision, techniques such as Graph Neural Networks help identify multi-step attacks by modelling cloud interactions as structured graphs [178]. In addition, self-supervised learning proves useful when labelled datasets are scarce, allowing AI models to learn directly from unstructured logs [178]. Importantly, zero-trust AI frameworks powered by behaviour analytics and reinforcement learning now enable dynamic access control and micro-segmentation, effectively containing lateral movement and insider threats [178,180]. All these methods work in synergy to provide scalable, cloud-agnostic, and proactive security strategies. Without AI, maintaining uniform protection across heterogeneous cloud platforms such as AWS, Azure, and GCP would remain a fragmented and reactive process [179]. Hence, AI not only empowers real-time threat detection but also ensures that multi-cloud environments remain resilient, intelligent, and future-ready [176,177].

Table 10. AI Techniques In Multi-Cloud Security.

AI Techniques	Explanation	Primary Advantage
LSTM (Long Short-Term Memory) [177]	Used for time-series anomaly detection in multi-cloud logs by learning sequential patterns.	Achieved 96.5% F1-score in detecting abnormal network behaviour across AWS, Azure, and GCP.
Random Forest [177] & Gradient Boosting	Used as hybrid ensemble classifiers for threat classification in AI-based cloud security systems.	Higher detection accuracy than SVM and decision trees.
Reinforcement Learning (Q-Learning) [177]	Used for dynamic policy adaptation and firewall rule optimization based on real-time feedback.	Reduced false positives by 26% and improved response time by 19%
Self-Supervised Learning (SimCLR, LogBERT) [178]	Learns patterns from unlabeled security logs for detecting zero-day threats.	96.8% detection accuracy without human-annotated data.
Graph Neural Networks (GCN, GAT) [178]	Models cloud interactions as graphs to detect lateral movement and privilege escalation.	Reduced undetected attack rates by 43%
Federated Learning [178,179]	Enables anomaly detection across multi-cloud without sharing raw logs, preserving privacy.	92.5% accuracy and compliant with GDPR/HIPAA.
SVM, Decision Trees [176,177]	Traditional ML models for intrusion detection and traffic classification.	Useful in baseline detection tasks, though less accurate than DL models.
AI-based SOAR [178]	Automates incident response with threat intelligence feeds and deception systems.	Reduced MTTD by 53% and MTTR by 47%
Zero-Trust AI [178,180]	Uses real-time behavioural risk scoring and micro-segmentation with reinforcement learning.	41% reduction in insider threats.

presents various AI techniques applied in multi-cloud security, highlighting their purposes and primary advantages in enhancing threat detection, anomaly detection, policy adaptation, and incident response.

AI-based techniques analyses indicate that deep and reinforcement learning models are proficient at identifying and automating responses to dynamic threats. However, their reliance on considerable, high-quality datasets constrains their generalization across heterogeneous clouds. Although federated and graph-based learning approaches address some problems related to data sharing and contextualization, challenges such as explainability and real-time adaptability remain unsolved. The latest advancements in hybrid AI frameworks that integrate predictive analytics with zero-trust micro-segmentation to achieve intelligent, continuous protection across distributed cloud environments.

6.3. ML Techniques for Multi-Cloud Security

Machine learning in multi-cloud security typically involves using algorithms which learn patterns from the vast data across multiple cloud platforms to automatically detect and respond to security issues [181,182]. This strategy is highly significant because traditional rule-based and manual security solutions struggle to deal with the size and complexity of multi-cloud settings [181,183,184]. Conventional tools often fail against new cyberattacks in these distributed cloud setups, which is making AI-driven anomaly detection and analysis increasingly important [121,181]. By applying machine learning, organizations can analyze large volumes of cloud logs and user behaviours to spot unusual patterns or threats in real-time and then predict potential system failures or breaches before they can happen [121,181,185]. They are also able to modify resource allocations or security restrictions [181,182] quickly. This means security teams get proactive warning of suspicious activities and automated assistance in neutralizing risks [121,181]. In summary, machine learning adds an intelligent, adaptive layer of defence that enhances the reliability and safety of multi-cloud [121,181,182,184].

Table 11. Machine Learning Techniques in Multi-Cloud Security.

ML Technique	Explanation	Primary Advantage
Deep Learning (SSAE, DNN, CNN, LSTM) [121,181]	Deep models (especially Stacked Sparse Autoencoders in healthcare multi-cloud) are used to detect subtle or evolving threats from high-dimensional data.	High detection accuracy (>98%), reduced false positives, scalable to edge-core-cloud pipelines.
Reinforcement Learning [181]	Proposed as a self-adaptive model for adjusting security decisions based on cloud environment feedback. Mentioned as a future trend in adaptive ML.	Enables intelligent, context-aware, dynamic policy tuning for evolving cloud threats.
Federated Learning [182,184]	Mentioned as a promising privacy-preserving method to train ML models across clouds without sharing raw data; applicable to multi-cloud pipelines.	Maintains data locality while improving threat intelligence collaboratively across providers.

outlines key machine learning techniques in multi-cloud security, explaining their applications and highlighting their primary advantages in threat detection, classification, adaptability, and privacy preservation.

The analysis indicates that machine learning techniques have undeniably strong capabilities for detecting anomalies and intrusions. However, they still contend with issues such as a lack of available labels, data imbalance, and dynamically changing attack patterns. In terms of precision, deep architectures such as CNN and LSTM outperform classical approaches, whereas federated models preserve data privacy across providers. Future research should focus on analyzing adaptive self-learning ML pipelines that autonomously retrain when an environment drifts while ensuring confidentiality and minimal latency.

6.4. Fuzzy-Logic Techniques for Multi-Cloud Security

Fuzzy logic has emerged as a powerful tool in multi-cloud security due to its ability to handle uncertainty, ambiguity and imprecision in decision-making. Since cloud environments involve constant changes in trust, risk and resource demands, fuzzy systems help in making smarter decisions. For example, it enables accurate fault detection and automatic task migration using performance metrics such as throughput and response time [186]. It also improves energy efficiency and secure job scheduling by weighing multiple factors such as job size, memory and required security levels [187]. In terms of trust, fuzzy logic combines subjective feedback and objective SLA data to assess service provider reliability more effectively [188]. Moreover, risk analysis becomes more realistic when threats, vulnerabilities, and asset values are treated as fuzzy variables instead of fixed numbers [189]. Recent works show that fuzzy logic adapts well to load balancing, QoS control, and security prediction across various cloud services [190,191]. In provisioning, fuzzy rules optimize resource scaling and reduce SLA violations by reacting to real-time workload fluctuations [192]. It is also powerful in detecting over-privileged access by evaluating user behaviour and permission strength fuzzily [193], and in building adaptive intrusion detection systems with lower false alarm rates [194]. Finally, fuzzy models help quantify layered security risks in MFA and container orchestration, which is crucial for modern multi-cloud setups [195]. All these show that fuzzy logic not only simplifies decision-making but also adds a layer of intelligent control to complex, distributed cloud systems.

Table 12. Fuzzy Logic Techniques In Multi-Cloud Security.

Fuzzy Logic Techniques	Explanation	Primary Advantage
Dual Fuzzy Fault Tolerance System [186]	Two fuzzy modules: one for fault detection, one for response; based on system metrics such as response time and throughput.	Achieved 98.03% fault detection accuracy; reduced recovery time.
Fuzzy Inference for Job Scheduling [187]	Fuzzifies job length, energy use, memory, and security level to select a suitable VM.	Minimizes makespan and improves resource utilization.
Fuzzy Rule-Based Trust Management [188]	Combines subjective feedback and SLA metrics using fuzzy rules to calculate trust levels.	Detects fake feedback, improves trust reliability by up to 20%
Fuzzy Risk Assessment Model [189]	Uses asset, threat, and vulnerability matrices; weighted by entropy; mapped through fuzzy evaluation	Enables granular risk evaluation and prioritization
Fuzzy Firefly and Load Partitioning [191]	Divides cloud into partitions; fuzzy + firefly algorithm routes load to optimal segment.	Handles heavier loads, reduces execution cost and time.
Fuzzy Neural Network Scheduler [191]	Converts input data into linguistic variables, optimized using GA for job-resource mapping.	Reduces completion time and bandwidth use.
Fuzzy-AHP + DMM + FIS (FuzzyFortify)  [195]	Multi-layered fuzzy model combining AHP and domain mapping for MFA and container risk analysis.	Identifies critical risk nodes in authentication and orchestration.
Fuzzy Trust Evaluation (IOWA Aggregation)  [191]	Uses CPU, disk, data transfer metrics; fuzzified per time slot; aggregated using IOWA operator.	Captures dynamic trust fluctuations in services.
Fuzzy SLA-Based Provisioning [192]	Applies fuzzy rules to workload and resource usage (e.g., CPU, task queue) to trigger VM scaling.	Improved CPU utilization (up to 98.27%) and reduced SLA violations.
Fuzzy Access Control Risk Detection [193]	Evaluates user trust, resource sensitivity, and permission strength using 90 fuzzy rules.	Achieved ∼99% accuracy in detecting over-entitlements.
Fuzzy Intrusion Detection Framework [194]	Uses fuzzy classifiers with network attributes; combines with ML to reduce false alarms.	Improved generalization to unknown attacks and reduced false positive rate by 23%

summarizes various fuzzy logic techniques applied in multi-cloud security, highlighting their explanations and primary advantages in enhancing fault tolerance, trust, risk management, scheduling, and intrusion detection.

The analysis of fuzzy-logic frameworks demonstrates distinctive proficiency in managing uncertainty, evaluating trust, and performing multi-criteria decision-making in the context of variable workloads. Fuzzy systems offer interpretability and robustness in diverse contexts, extended beyond just having rule-based models. This becomes particularly effective when combined with artificial intelligence or machine learning for hybrid reasoning. Nevertheless, the extent of their accuracy and scalability remains limited to the manual tuning of rule sets. The integration of fuzzy inference, reinforcement learning, and policy-as-code frameworks could provide multi-cloud environments with adaptive security controllers tailored to their complexity.

6.5. IAM Approach for Multi-Cloud Security

Identity and Access Management (IAM) is one of the foundational pillars of multi-cloud security, ensuring that only authorized users and services can access sensitive data and resources, regardless of the cloud platform in use. As identity becomes the new perimeter, IAM approaches such as Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Multi-Factor Authentication (MFA) provide flexible yet strict access controls tailored to different user roles and conditions [196]. Moreover, techniques such as federated identity using OAuth, OpenID Connect, and SAML allow users to move securely across platforms without credential duplication [197,198]. This is particularly important for avoiding identity silos and ensuring seamless user experience in distributed architectures [199]. In recent years, the shift toward Zero Trust Architecture has redefined IAM by enforcing continuous verification and behaviour-based access decisions, making trust a dynamic, context-aware variable rather than a static rule [200,201]. To strengthen this, AI-driven systems have been integrated into IAM models to detect anomalies, automate policy enforcement, and dynamically assess identity risks [196,201]. In addition, microservice environments benefit from fine-grained access policies enforced through tools such as Open Policy Agent (OPA), allowing real-time, decentralized control [198]. Altogether, IAM not only safeguards against external threats such as credential theft or API abuse, but also reduces insider risks by applying least-privilege principles and monitoring user behaviour across cloud ecosystems [79,200]. Thus, in a world where cloud boundaries blur and attack surfaces grow, IAM serves as both the gatekeeper and the auditor of trust.

Table 13. IAM Techniques, Explanation, Primary Advantage.

IAM Technique	Technique Details	Key Benefits
Role-Based Access Control (RBAC) [79,196,199]	Assigns permissions based on predefined roles within the organization.	Simplifies access management, enforces least privilege, and reduces excessive access risks.
Attribute-Based Access Control (ABAC) [196,198]	Grants access based on dynamic attributes such as user location, device type or security clearance.	Enables fine-grained, context-aware access control- adaptable for microservices and multi-cloud.
Multi-Factor Authentication (MFA) [79,196,201]	Uses two or more verification factors such as passwords, biometrics, tokens for secure authentication.	Prevents unauthorized access even if credentials are compromised; mitigates credential theft and insider threats.
Federated Identity (OAuth, OIDC, SAML) [196,197,198]	Enables SSO and identity federation across cloud platforms; OAuth for delegation, OIDC for identity verification, SAML for SSO.	Reduces credential duplication, improves usability, supports cross-cloud authentication.
Zero Trust Architecture (ZTA) [196,200,201]	Enforces continuous identity verification, assumes no implicit trust, and uses dynamic policy evaluation.	Blocks lateral movement, reduces attack surface, enforces strict identity checks for every access attempt.
AI/ML-Driven IAM [196,201]	Uses machine learning for anomaly detection, risk scoring, adaptive authentication, and automated policy enforcement.	Enables real-time threat detection, reduces manual workload, and enhances the accuracy of access decisions.
Open Policy Agent (OPA) [198]	Implements ABAC in microservices; integrates with Envoy proxy for real-time, decentralized policy enforcement.	Provides fine-grained control over service-to-service access in multi-cloud; decouples logic from code.
Centralized IAM (SAP BTP) [201]	Combines AI-powered governance, real-time compliance checks, and centralized identity provisioning using the SAP BTP platform.	Achieves 99.97% policy accuracy, rapid threat detection, and cost-efficient IAM operations.
Identity Federation via Broker [198]	Custom identity broker translates identity between providers (e.g., Azure AD).	Ensures seamless identity integration across cloud platforms, reducing session inconsistency.
SIEM-Integrated IAM Auditing [196,198]	IAM logs are fed into SIEM systems for anomaly detection and compliance monitoring.	Improves visibility, detects policy violations, and supports regulatory audit trails.

presents different IAM techniques with their details and key benefits, showing how they enhance security, access management, and compliance in multi-cloud environments.

The analysis shows that IAM solutions continue to be fragmented, and also remain lacking in automated role synchronization and consolidated credential lifecycle management across providers. Centralized identity federations may improve visibility but also introduce single points of failure in policy. Architectures of emerging zero-trust IAM systems, along with decentralized identity protocols based on blockchain, show potential for establishing trust boundaries across multiple clouds. The combination of these with compliance-orchestrated governance layers represents a practical pathway for unified governance.

6.6. Emerging Technologies

Multi-cloud security is becoming increasingly secure with new technologies that solve real and growing problems. To begin with, Zero Trust Architecture plays a crucial role by ensuring that no user or device is automatically trusted. Instead, every access request is strictly verified using multi-factor authentication and continuous monitoring [202,203,204]. Additionally, Federated Learning helps train AI models across different cloud nodes without moving sensitive data, which protects privacy and reduces the risk of central data breaches [204,205]. Blockchain also contributes by securing cloud transactions through tamper-proof records and distributed consensus, allowing better transparency in multi-cloud operations [204]. In the case of intrusion detection, Swarm Technologies such as OBL-RIO improve the selection of network features using bio-inspired optimization, which leads to better accuracy and fewer false alerts [133,206,207,208]. In the meantime, the shift towards 6G technologies provides ultra-fast and intelligent support for distributed trust models, helping cloud and edge nodes coordinate securely in real-time [205]. In addition, to enhance decision-making transparency in cloud-based security systems, Explainable AI methods are being adopted, enabling analysts to understand threat classifications and reduce false positives [209]. In multi-cloud environments, Natural Language Processing (NLP) is also increasingly leveraged to enable secure, privacy-aware training of language models for analyzing textual threat intelligence and detecting social engineering attacks [210].

Table 14. Emerging Technologies Enhancing Multi-Cloud Security.

Emerging Technologies	Explanation	Key Benefits
Zero Trust Architecture [202,203,204]	Takes every access request as untrusted and verifies it strictly using MFA and policies.	Strengthens identity control and prevents unauthorized access in multi-cloud setups.
Federated Learning [204,205]	Distributes model training across multiple nodes without exposing raw data.	Enhances privacy, lowers data leakage risks, and supports real-time threat detection.
Blockchain [204]	Provides secure, decentralized logging and verification for cloud interactions.	Ensures integrity, traceability, and tamper-proof audit trails in cloud workflows
Swarm Technologies [133]	Applies rat-inspired optimization (OBL-RIO) to improve intrusion detection feature selection.	Increases detection performance and reduces false alerts in complex traffic data.
6G [205]	Combines AI-native security, federated trust, and ultra-low latency cloud support.	Enables fast, distributed, and secure cloud-edge coordination under 6G networks.
Explainable AI [209]	Uses interpretable models such as SHAP and LIME to explain AI-driven security decisions in real time.	Increases analyst trust, reduces false alarms, and improves response clarity in multi-cloud setups.
NLP [210]	Enables secure training and deployment of language models for threat intel and communication analysis.	Supports the detection of phishing, social engineering, and chatbot misuse while preserving privacy.

highlights emerging technologies that enhance multi-cloud security, describing their mechanisms and emphasizing key benefits such as stronger identity control, improved privacy, secure logging, better intrusion detection, and advanced threat response.

The analyses indicate that progress in blockchain technology, alongside quantum-resistant cryptography and AI-driven orchestration, reflects a transformative movement toward autonomous and trustless verifiable environments of the multi-cloud. The synthesis suggests a greater utilization of interoperable testbeds for validating these innovations with real-world workloads. Future steps in progress may focus on balancing technological advancements with governance, prioritizing that resilience, cost efficiency, and regulatory compliance evolve together with next-generation distributed cloud architectures.

6.7. Enterprise-Grade Solutions

While academic proposals have introduced a wide range of cryptographic, AI, fuzzy-logic, and IAM-based defences, real-world deployment increasingly depends on enterprise-grade solutions. Modern enterprise environments are increasingly dependent on integrated security management platforms that extend beyond traditional academic or experimental models. These consist of Cloud-Native Application Protection Platforms (CNAPP), Cloud Workload Protection Platforms (CWPP), and Cloud Security Posture Management (CSPM). These solutions serve as frameworks that integrate compliance supervision, workload defence, and protection at runtime over dispersed cloud infrastructures. CSPM helps automate the enforcement of compliance and detects configuration drift while also aligning with the research efforts on governance-aware cloud orchestration [211,212]. By integrating vulnerability management with behavioural monitoring, CWPP ensures host- and container-level security, paralleling academic proposals for context-aware anomaly detection(Non-peer-reviewed source [213]). CNAPP provides unified visibility and adaptive response pipelines, which extend these capabilities and effectively implement multi-layered defence architectures(Non-peer-reviewed source [212,214]).

From this analysis, it indicates that academic approaches mainly focus on conceptual innovations such as federated intelligence sharing, adaptive cryptography, and explainable AI, while enterprise tools concentrate on operational scalability and automation. The combination of both perspectives reveals a convergence whereby theoretical frameworks guide the advancement of business systems, while the real-world applications feed back on and polish the theoretical constructs. This integration demonstrates the increasing convergence of research with the practical aspects of securing contemporary multi-cloud environments.

Table 15. Enterprise Security Solutions in Multi-Cloud Environments.

Solution	Description	Key Features
CSPM (Non-peer-reviewed source [211,212])	Utilizes AI and rule-based automation for remediation and policy enforcement, and identifies misconfigurations and compliance gaps in multi-cloud.	Automated detection of misconfigurations; Continuous alignment with regulatory frameworks
CWPP (Non-peer-reviewed source [213])	Secures workloads, including VMs, containers, and serverless functions through runtime protection, vulnerability management, and behavioural analytics to detect and prevent exploits.	Real-time threat detection across hybrid workloads; Vulnerability scanning, patching, and micro-segmentation
CNAPP (Non-peer-reviewed source [212])	Unifies CSPM and CWPP functions to secure cloud-native applications across their entire lifecycle using integrated APIs and identity analytics.	Enhanced visibility of microservices, APIs, and containerized workloads

presents a summary of these enterprise solutions concerning their primary functions, advantages, and significance in relation to a multi-cloud environment.

7. Research Gap

While multi-cloud security has evolved considerably, critical gaps remain. These areas that are frequently ignored weaken the robustness and effectiveness of current methods. Addressing these issues is essential for guiding future research efforts aimed at strengthening the security of multi-cloud environments.

7.1. Heavy Reliance on Simulation Without Real-World Cloud Validation

A critical shortcoming in the current state of research is the reliance on simulation environments such as CloudSim and iFogSim for the validation of multi-cloud architectures. This reliance on simulation environments deeply undermines the real-world relevance of the proposed models. Such simulators abstract away crucial infrastructure behaviours. For example, these include virtual machine boot delays, API rate limiting, network jitter, the likelihood of an availability zone outage, and the expenses for specific regions. Additionally, they are unable to accommodate service-specific details, which leads to an unrealistic representation of system behaviour. Consequently, insights gained from simulation environments often are incapable of leading to production systems that are deployable, resilient, or efficient. This gap can be addressed by shifting the research focus toward reproducible benchmarking environments using Infrastructure-as-Code (IaC) tools, such as Terraform or Pulumi, to provision actual resources across providers. Multi-cloud service meshes such as Istio and Consul provide routing, observability, and failover, while service orchestration can be managed through Kubernetes Federation (KubeFed). Continuous performance measurement, SLA tracking, and auditing of associated costs will be enabled by Integration with monitoring stacks such as Prometheus and Grafana. Importantly, experiments must include live billing analysis, compliance verification, and API compatibility validation. This transition from hypothetical concepts to practical operations is crucial for achieving resilient, scalable, and production-grade multi-cloud research.

7.2. Fragmented Security Controls and Absence of Federated Trust Models

In multi-cloud deployments, the failure to establish a cohesive, cross-platform, and flexible security architecture remains one of the most difficult obstacles to secure operational security. Most existing models were built under the assumption of a homogeneous trust model. Such environments do not exist in real-world federated environments involving third-party services, hybrid clouds, and decentralized edge nodes. Access control definitions remain static as they rely on older RBAC models or ABAC models, which are too simplistic to capture real-time context such as user location and behavioural deviations. Additionally, the absence of established trust negotiation protocols results in the continued fragmentation and insecurity of identity federation and cross-provider data sharing. To address these limitations, future research should shift towards implementing decentralized trust architectures based on blockchain-based identities and distributed reputation systems to validate and score identities. Smart contracts can enforce data governance and auditability policies, guaranteeing both regulatory compliance and interoperability simultaneously. Coupling this with zero-trust identity fabrics will ensure adaptive, policy-consistent access in even the most dynamic environments. Moreover, adopting context-aware ABAC engines backed by policy-as-code frameworks, such as OPA, would enable dynamic enforcement of security policies based on time, geography, access frequency, and other risk dimensions. Most importantly, these mechanisms also need to be enhanced with compliance-aware filters to ensure that decisions on data placement, access, and replication decisions align with cross-border privacy laws and are synchronized with jurisdictional requirements. The outcome is a unified, resilient, and legally compliant security layer for multi-cloud environments.

7.3. Lack of Real-Time, Cross-Cloud Threat Intelligence and Response

The new attack surface that expands as a result of modern multi-cloud architectures is characterized by distributed control planes and heterogeneous security capabilities of various cloud providers. Despite these persistent challenges, the majority of existing threat-detection systems remain siloed, depending on offline-trained, provider-specific, non-collaborative, and machine learning models, as well as rule-based algorithms. Such systems do not possess the architectural ability to combine asynchronous and distributed within-space threat indicators, such as unusual login attempts in one cloud and concurrent lateral movement in another. Furthermore, existing approaches overlook the continuous nature of attack evolution, leaving them unable to defend against polymorphic and zero-day attacks that adapt faster than signature updates. However, a consolidated behavioural intelligence layer that can aggregate, normalize, and analyze activity patterns across clouds does not exist. This leads to an environment where subtle behavioural deviations, such as anomalous API call patterns or unauthorized lateral movements, go undetected because each cloud sees only a partial picture. This matters especially for detecting stealthy threats, insider attacks, or fraud that span federated services. The consequence is reduced visibility, delayed detection, and a fragmented response posture. To respond appropriately, an improved federated threat detection framework must be architected, which includes real-time ingestions of telemetry from various clouds, cross-border intelligence sharing through standard protocols and online model updating through federated learning techniques. In addition to employing graph neural networks (GNNs) to represent and reason about the interrelated behaviours of the user and entity, these approaches can provide context-aware, precise anomaly detection. When combined with a zero-trust access architecture, such systems would dynamically enforce fine-grained security decisions at runtime, transforming cloud security from static, perimeter-based defence to adaptive, scalable risk mitigation.

7.4. Cost Optimization Strategies Ignore Dynamic Constraints and SLA Penalties

Despite the existence of numerous models to reduce the cost of infrastructure in multi-cloud architectures, they remain fundamentally inadequate in modelling the full complexity of operational environments. Due to the heterogeneous billing structures, dynamic pricing, and hidden operational costs imposed by different cloud providers, the cost modelling of multi-cloud environments remains fragmented and disjointed. Many orchestration strategies optimize for either performance, such as minimizing latency or cost, such as query minimization, but these strategies rarely consider a combination of many real-world constraints. Existing approaches often optimize for static cost parameters such as hourly VM rates or compute unit pricing, while ignoring a multitude of dynamic and context-sensitive variables, including spot price volatility, IOPS-based storage pricing, and SLA penalties for underperformance. Moreover, the optimization logic within several frameworks is not designed to handle non-linear trade-offs between conflicting objectives, such as minimizing cost while ensuring high availability and low latency. Most approaches also overlook workload heterogeneity and do not model user-specific preferences or data compliance constraints. To overcome this, frameworks focused on cost optimization need to transform into multi-objective, SLA-aware optimization engines that can dynamically allocate resources through deep reinforcement learning, multi-objective evolutionary algorithms, or even Bayesian optimization. Such models would need to have the capability to process real-time pricing data and predict SLA breaches and penalties, and QoS preferences. In addition, integrating carbon-intensity APIs and data locality-aware schedulers will enable workload placement based on monetary expense, energy consumption and compliance risk. This shift facilitates resource orchestration that is SLA-compliant, cost-efficient, and sustainable across dynamic multi-cloud environments.

7.5. Lack of Explainability and NLP-Driven Automation in Multi-Cloud Threat Detection and Intelligence Integration

In the evolving landscape of multi-cloud security, two critical research gaps have been identified that compromise the efficiency, transparency, and flexibility of the systems for intelligent threat detection. The initial gap concerns the absence of Explainable Artificial Intelligence (XAI) in deep learning-based threat detection models, especially those using Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks. While these models are successful at anomaly detection and attack classification, they tend to operate as non-transparent systems, providing minimal explanation of their decision-making processes. The absence of transparency creates significant challenges in mission-critical environments where security analysts must justify and audit automated security actions such as access denial, account isolation, or resource suspension. Moreover, a lack of explanation of model outputs impairs the retraining and validation of processes as the threat landscape evolves. Although SHAP, LIME, and attention-weighted visualization techniques offer potential solutions, their integration in the operational pipelines remains insufficient. The second gap concerns the underutilization of Natural Language Processing (NLP) in real-time threat intelligence integration within Security Information and Event Management (SIEM) and Security Operations Center (SOC) platforms. Even with the increasing volume of unstructured threat data, such as advisories, vulnerability reports, and analyst-authored alerts, manual triage remains the standard, resulting in lagging responses and heightened analyst burnout. NLP-based real-time enrichment using domain-specific large language models (LLMs) and intelligent co-pilots can significantly enhance contextual analytical understanding and decision-making capabilities by transforming unstructured feeds into actionable insights. Bridging these two gaps through the integration of interpretable AI and NLP-enhanced automation is essential for establishing transparent, efficient, and adaptable multi-cloud security infrastructures.

7.6. Lack of Robust Data Provenance and Lineage Across Multi-Cloud Environments

In the analyzed literature on data security and trust, a major shortcoming is the absence of dependable data lineage tracing throughout multiple providers. As organizations spread their processing and storage across numerous cloud services, data undergoes transformation, duplication, and movement, often lacking an identifiable, secure log of its origins, subsequent usage, and any alterations that were made. This creates severe compliance, integrity, and forensic risks, particularly when sensitive datasets such as financial records and health data are involved, as well as when service boundaries are crossed. Existing logging mechanisms, such as those offered by CSPs such as AWS CloudTrail, are limited in integration and have restrictive scopes. An effective data provenance framework should integrate timestamped hashes, cryptographic commitments, and immutable logs to achieve comprehensive traceability. Leveraging blockchain or distributed ledger technology (DLT) can ensure that data flow events are both transparent and tamper-proof. Research should focus on ensuring that provenance protocols are cloud-native, scalable, object-store, stream-processor, and container-runtime-friendly, all while achieving low-latency and high-throughput performance. Provenance should additionally be semantically enriched by connecting access logs to business policies, user actions, and system status. This would result in raw data trails being transformed into auditable records, which would be compliant with regulations.

8. Conclusions

In this paper, we present a comprehensive literature review that integrates different areas of research on multi-cloud environments, security threats, defence mechanisms, cost, SLA-aware orchestration, provenance, and privacy, which have been studied individually. Moreover, multi-clouds increase both operational trade-offs and technical complexity. As illustrated in the literature review, some defences which improve confidentiality or integrity exacerbate both latency and cost. Cost-cutting measures increase the attack surface. Additionally, provider diversity makes consistent policy enforcement and forensic analysis more difficult. Identifying these inter-dependencies is critical for formulating effective, actionable solutions for real-world multi-cloud deployments. Our survey also highlights several distinct trends and potential techniques, such as federated and privacy-preserving learning techniques used for cross-cloud anomaly detection, application of graph neural networks for service behavioural correlation across services, use of zero-trust architectures, service meshes for mitigating lateral movements, and stronger data provenance through cryptographic approaches. However, in all these areas, we found that much of the work remains in the experimental phase, often confined to simulations, and few studies evaluate solutions under realistic, adversarial conditions or at production scale. We also emphasize critical gaps that require the most focus. Cross-provider policy synchronization and unified IAM semantics are still unresolved issues. There is also a lack of comprehensive, federated SIEM and threat-intelligence sharing systems. XAI is underexplored, as is the case with the explainability of AI-driven detectors. There is insufficient development on end-to-end, multi-cloud cryptographic and verifiable provenances. Finally, there is a lack of combined optimization of cost, compliance, availability, and sustainability demands for SLA-aware and regulation-informed orchestration strategies.

Based on the review, we recommend that the research community focus on the following:

• Federated, privacy-preserving detection layers with threat sharing standardization
• XAI validation for ML models applied to security issues
• Cross-cloud provenance systems combining cryptographic commitments with immutable logging
• Multi-objective cost, compliance, availability and environmental impact optimization in orchestration.

Importantly, these efforts should be validated on publicly available benchmarks and real-world testbeds, using adversarial evaluations and longitudinal studies to measure operational robustness and operational costs. Another significant contribution of this study lies in its multi-directional scope. In contrast to prior research, which typically focuses on a single dimension, such as security threats, defence mechanisms, or cost optimization, this work deliberately integrates multiple perspectives. This approach enables researchers to investigate interrelated trade-offs and comprehend implications on a broader system level. In conclusion, securing the distributed skies of multi-cloud environments will require integrated technical, operational, and policy solutions. Through the integration of existing insights, highlighting recurring challenges, and proposing a well-defined research direction, this study aims to support the development of transparent, resilient, and practically applicable multi-cloud security frameworks that are appropriate for real-world adoption.