Cloud security risks still an issue for CIOs, but change is in the air