Cloud compliance pulse shows privileged MFA gaps are still widespread

At a glance

What this is: This is a cloud identity compliance benchmark showing that high-severity gaps remain common, with privileged-account multifactor authentication the most frequently violated control.

Why it matters: It matters because IAM, PAM, and cloud security teams are being measured not only on access hygiene but also on audit readiness, insurance scrutiny, and breach reduction.

By the numbers:

• 94% of participating organisations exhibited at least one high-severity gap.

👉 Read Unosecur’s Cloud Compliance Pulse H1 2025 on privileged MFA gaps in cloud estates

Context

Cloud compliance failures are often treated as a checklist problem, but this benchmark shows a governance problem: organisations still leave privileged identities protected by inconsistent controls. When privileged MFA, role design, credential age, and service-account handling drift apart, the cloud estate stops behaving like a controlled identity system and starts behaving like a collection of unmanaged exceptions.

The article’s central finding is that these weaknesses are not isolated. They cluster into a small number of repeatable control families, which means the issue is less about finding a single misconfiguration and more about whether IAM, PAM, and cloud governance are operating as one lifecycle.

Key questions

Q: What breaks when privileged cloud accounts are not protected by multifactor authentication?

A: The control boundary breaks because privileged access can be reused through stolen passwords, phishing, or replayed sessions. In cloud estates, that often means an attacker can reach administrative functions without needing to compromise a second factor, which turns a single credential into broad tenant-level risk.

Q: Why do stale privileged accounts create more risk than their role names suggest?

A: Because the risk is driven by what the account can still do, not by whether anyone remembers assigning it. Privileged accounts that are inactive, lightly monitored, or rarely reviewed often retain broad access long after the original business need has passed. That makes them attractive for abuse and difficult to defend during audit or incident response.

Q: What are the signs that non-human identity governance is failing in cloud environments?

A: Common warning signs include credential sprawl, long-lived API keys, unrotated certificates, unclear ownership, and workloads with more access than they need. Another red flag is when teams cannot quickly show who or what accessed a resource, or when access decisions are still handled manually. Those symptoms usually point to weak visibility, weak policy enforcement, or both.

Q: How should organisations manage privileged access for service accounts and secrets?

A: They should treat privileged non-human identities as governed assets with named ownership, defined purpose, rotation, and revocation. The main failure mode is standing privilege with no lifecycle control. PAM should inventory the account or secret, limit its scope, time-box its use, and make revocation automatic when the business need ends.

Technical breakdown

Why privileged-account MFA remains the control boundary

Privileged-account multifactor authentication is the most basic boundary between ordinary login risk and administrative compromise. In cloud estates, privileged access often spans consoles, APIs, and federated identity paths, so a missing second factor leaves the highest-impact accounts exposed to password reuse, phishing, and credential stuffing. ISO 27002 5.17 matters here because it applies the stronger authentication requirement exactly where the blast radius is largest. The report’s finding is not that MFA is difficult in theory, but that governance still fails to make it universal for privileged identities.

Practical implication: enforce MFA coverage for every privileged identity path, including federated access and break-glass administration.

How over-privilege and stale credentials multiply audit findings

Over-privileged roles, duplicate credentials, and unmanaged service-account keys create the conditions for repeated findings across the same tenant. Once access is granted permanently, every unused entitlement, old key, or duplicate secret becomes both a control failure and an evidence problem during audit. This is why the report links high gap counts to longer certification cycles: auditors are not just seeing a misconfiguration, they are seeing a governance model that cannot prove who should still have what access. In practice, the technical issue is lifecycle drift, not a one-off permissions mistake.

Practical implication: review standing entitlements and key age as lifecycle controls, not as isolated hygiene checks.

Why service-account secrets need the same governance as user access

Service-account keys and other machine credentials are part of the same identity plane as human administrator access, yet they are often governed separately. That split is risky because a leaked or long-lived secret can bypass user-centric controls entirely and give sustained access to cloud resources. The article’s focus on managed vaults is a reminder that storage alone is not governance; ownership, rotation, revocation, and inventory are what make a secret manageable. Once a service-account secret escapes those controls, the estate has effectively lost visibility over a privileged non-human identity.

Practical implication: bring service-account credentials into the same inventory, rotation, and offboarding discipline as human privileged accounts.

Threat narrative

Attacker objective: The objective is to preserve high-value cloud access long enough to reach sensitive workloads, data, or administrative controls without triggering immediate detection.

1. Entry occurs through a privileged cloud account or service credential that lacks adequate multifactor protection or is exposed through weak secret handling.
2. Credential access is sustained by stale, duplicate, or unmanaged keys that remain valid beyond their intended lifecycle.
3. Impact follows when the attacker or unauthorized actor uses the exposed privilege to reach cloud resources, create audit evidence gaps, or support breach activity.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privileged MFA is no longer a point control, it is a programme boundary. When 68% of cloud tenants still fail privileged-account MFA, the issue is not a missing checkbox but a weak trust model. If privileged access can exist without strong authentication in any cloud path, the organisation has already accepted exception-driven governance. The practitioner conclusion is that MFA coverage must be treated as a control boundary for the entire identity programme, not as a local configuration task.

Four gap families tell us the cloud identity problem is lifecycle drift, not isolated misconfiguration. Missing MFA, over-privileged roles, stale credentials, and unmanaged service-account keys are different symptoms of the same governance failure. They show that ownership, review, and offboarding are not keeping pace with how access is created and retained. The practitioner conclusion is that identity governance has to be measured as a lifecycle system, not as a series of periodic clean-up exercises.

Cloud compliance is converging with insurance and incident-response economics. The article links identity gaps to higher audit burden, premium pressure, and breach likelihood, which means IAM decisions now influence finance and resilience at the same time. That convergence makes privileged access evidence a board-level issue rather than a technical report. The practitioner conclusion is that identity teams must be ready to defend controls in audit, underwriting, and incident review with the same underlying data.

Managed vaults do not solve unmanaged ownership. The report’s focus on service-account secrets shows that storage is only one control layer. A vault without clear inventory, rotation, and revocation still leaves organisations unable to say who owns a secret, when it expires, or how it is retired. The practitioner conclusion is that machine credentials must be governed as living identities, not as static assets.

Identity blast radius is now the right way to think about cloud compliance. The real question is not whether one control fails, but how many downstream findings one weak privileged path creates. This article shows why cloud IAM, PAM, and evidence collection should be designed together. The practitioner conclusion is to measure how much audit, breach, and insurance exposure each privileged identity can create when controls drift.

What this signals

Cloud identity programmes should be measured by whether they can prove control over privileged access, not by whether they have a policy on paper. When MFA exceptions, stale keys, and unmanaged service-account secrets start to overlap, the organisation has a governance problem that will surface in audit evidence long before it surfaces in a dashboard.

Identity blast radius: the useful metric is how many audit, breach, and insurance consequences one weak privileged path can create. Teams that can only count accounts but not govern the downstream effect of access drift are measuring the wrong thing.

For practitioners

• Tighten privileged MFA enforcement Require multifactor authentication for every privileged cloud path, including federation, emergency access, and administrator consoles. Verify that exceptions are time-bound and separately approved.
• Reduce standing admin roles Replace permanent high-privilege assignments with just-in-time elevation and document the business owner for each privileged role.
• Track key age as a governance metric Measure the age distribution of access keys monthly and retire keys that exceed policy, especially where service accounts support production workloads.
• Bring service-account secrets into the identity inventory Inventory service-account secrets alongside human privileged accounts so rotation, revocation, and ownership reviews use one governance process.

Key takeaways

• This benchmark shows that privileged identity failures in cloud estates are still common enough to affect compliance, resilience, and access governance at the same time.
• The evidence points to a repeating pattern of weak MFA, standing privilege, stale credentials, and unmanaged service-account secrets rather than one-off mistakes.
• Teams that want better outcomes need to treat privileged access, key management, and secret ownership as one lifecycle problem.

Key terms

• Privileged MFA: Privileged multifactor authentication is the requirement that administrative or otherwise elevated access must be verified with more than one factor. In cloud identity programmes, it is one of the clearest controls for reducing the value of stolen credentials and limiting unauthorised administrative action.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Service-Account Secret: A credential used by a non-human identity such as a workload, integration, or automation account. Unlike human login credentials, these secrets often outlive the task they support unless they are inventoried, rotated, and revoked through a formal lifecycle process.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full report

Unosecur's full news post covers the operational detail this post intentionally leaves for the source:

• The full sampling methodology behind the 50-company benchmark and how the stratified sample was assembled
• The exact control-mapping approach to ISO 27001/27002, PCI DSS v4, SOC 2, CIS v8, and GDPR
• The month-by-month executive metrics Unosecur recommends for audit, insurance, and cloud governance reporting
• The remediation playbook details for privileged MFA, key rotation, and just-in-time elevation

👉 Unosecur’s full post covers the benchmark method, control mapping, and remediation guidance for cloud identity leaders.

Deepen your knowledge

NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.