Systematic Literature Review of AI-Driven Multi-Cloud Anomaly Detection in Zero-Trust Frameworks

Multi-cloud is becoming more challenging to secure as traditional perimeter-based security models have a hard time protecting workloads running across multiple cloud platforms, identities, and services. To address this challenge, organizations are shifting to Zero-Trust Architecture (ZTA), which focuses on constant verification and stringent access control, coupled with anomaly detection methodologies to gain better visibility and threat detection in the distributed cloud environment. This paper presents a Systematic Literature Review (SLR) of anomaly detection approaches in multi-cloud environments and how these are applied in zero-trust security models. The review is conducted according to the guidelines of the 2020 Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA 2020), and is based on studies published between 2020 and 2025 selected from the databases of the following journals: Institute of Electrical and Electronics (IEEE) Xplore, Science Direct, MDPI, Google Scholar, and the Saudi Digital Library. Studies found on benchmark datasets such as CICIDS-2017 and UNSW-NB15 are not evaluated, as none addressed real multi-cloud environments. Although zero trust is highlighted in general, very few studies have implemented basics of zero trust such as micro-segmentation, identity federation, and enforcement through policy. Overall, this review identifies gaps around cross-cloud validation, explainability, and compliance-aware security design, including lack of attention to regulations such as the GDPR and HIPAA. These findings provide helpful recommendations for future research and development on practical and security solutions for multi-cloud environments.