Cloud security access management gaps are widening in multi-cloud

At a glance

What this is: This is an analysis of cloud security access management gaps in multi-cloud, with the key finding that manual credential handling and incomplete lifecycle controls leave organisations exposed.

Why it matters: It matters because IAM and PAM teams have to govern cloud access across joiners, movers, leavers, contractors, and non-human accounts without assuming one control model will cover all cloud estates.

By the numbers:

• In 2022, Bravura Security surveyed 100 security leaders on cloud security access management.
• 49% of teams used spreadsheets to store cloud passwords.
• 75% managed application credentials this way.
• 70% reported they cannot remediate compromised or non-compliant passwords within 24 hours.

Context

Cloud security access management is the governance layer that decides who or what can reach cloud resources, under what conditions, and for how long. In multi-cloud estates, that control problem becomes harder because access rules, credential stores, and operational ownership are often split across platforms and teams.

The article argues that the main issue is not simply the number of controls in place, but the gap between identity change and access change. When password handling, revocation, and lifecycle reviews lag behind workforce movement and cloud sprawl, the result is persistence risk, audit friction, and slower recovery.

Key questions

Q: What breaks when cloud access management still relies on spreadsheets and manual cleanup?

A: The control breaks at ownership, rotation, and recovery. Credentials stored in spreadsheets are easy to copy, hard to govern, and slow to revoke after compromise. Manual cleanup also leaves gaps between detection and action, which is enough time for rogue access or stale privileges to be abused across cloud environments.

Q: Why do weak cloud remote access controls increase breach risk?

A: Weak remote access controls increase breach risk because they expose the entry paths that connect users, devices, and cloud resources. If those pathways are not tightly governed, an attacker can reach sensitive systems through an ordinary access channel instead of breaking in through a visible perimeter. That is why remote access must be treated as a privileged path.

Q: How do you know if joiner-mover-leaver controls are actually working in cloud environments?

A: They are working only if identity changes propagate quickly into every cloud admin plane and stale access disappears without manual chasing. A good test is whether leaver access, contractor access, and role-change access are removed or adjusted before they can be reused.

Q: What should security teams do when passwordless and SSO still leave fallback access paths?

A: Treat fallback access as a governed control path, not an exception. Review who can use it, when it is triggered, and how quickly it is revoked after use. If the fallback path is weaker than the primary one, attackers will target it.

Technical breakdown

Why spreadsheet-based credential handling keeps failing in cloud access management

Spreadsheet-driven password storage creates an uncontrolled distribution problem. Credentials end up duplicated, copied into side channels, and protected only by the security of the file and the people who can open it. In cloud environments, that is especially dangerous because access often spans SaaS, infrastructure, and admin functions at once. The issue is not just exposure of a secret. It is the absence of a governed credential lifecycle, which means no reliable owner, no consistent rotation discipline, and weak evidence for audit or incident response.

Practical implication: move cloud credentials out of ad hoc files and into governed storage with ownership, rotation, and revocation controls.

How joiner-mover-leaver gaps create rogue cloud access

Joiner-mover-leaver processes are supposed to keep identity state aligned with employment state. In practice, cloud access often persists after a role change or departure because the offboarding step is slow, partial, or manually routed through different platforms. That creates rogue accounts and over-retained access paths, especially where contractors, temporary staff, and service-linked identities are involved. The key technical weakness is lifecycle fragmentation: identity changes in one system, but entitlements remain live in another. In multi-cloud, that fragmentation is multiplied by different admin planes and inconsistent automation.

Practical implication: tie offboarding and mover workflows to every cloud admin plane that can retain standing access.

Why password policy enforcement is not the same as password recovery speed

Being able to enforce a password policy is not the same as being able to remediate a compromise quickly. A policy can exist on paper while the operational path to rotate or replace a compromised credential still takes days. In cloud security, that delay matters because attackers exploit the window between detection and revocation. The article also shows why backup authentication paths need equal attention. If passwordless or SSO is used but fallback access remains weakly governed, attackers can pivot through the exception path instead of the primary one.

Practical implication: measure the full credential recovery path, including emergency and fallback access methods, not just policy coverage.

NHI Mgmt Group analysis

Cloud access management has become a lifecycle problem, not a login problem. The article shows that many organisations can still enforce policy but cannot complete the downstream work of revocation, recovery, and exception handling at the same speed. That means the control failure sits in identity operations, not in authentication alone. Practitioners should treat cloud access as a governed lifecycle with measurable handoff points, not as a static access rule set.

Manual credential storage is a governance failure, not just an operational shortcut. When passwords and application credentials live in spreadsheets, the organisation loses ownership clarity, rotation discipline, and reliable audit evidence. The result is trust placed in a file format instead of in a managed identity process. The named concept here is credential governance debt: the longer secrets are managed manually, the more recovery and audit costs accumulate across cloud estates.

Rogue access is what happens when identity state and cloud state drift apart. The article’s discussion of leavers, movers, contractors, and non-human accounts shows that a single HR event can leave multiple access paths behind if lifecycle orchestration is incomplete. This is why cloud access governance has to include third-party and non-human identities, not only employees. Practitioners should judge their programme by how quickly it eliminates stale entitlements after identity change.

Centralised identity control only helps if exceptions are governed as tightly as the standard path. SSO, passwordless, and policy enforcement reduce friction, but fallback access and emergency recovery still create exploitable edges if they are not equally controlled. In multi-cloud environments, those edges are where recovery, compliance, and attack resistance either hold or fail. Teams should focus on the weakest operational path, not the most polished authentication path.

From our research library:

• Valid account abuse was responsible for 35% of cloud-related incidents, according to CrowdStrike's 2025 Global Threat Report.

What this signals

Cloud access control only works when revocation is as mature as provisioning. In multi-cloud programmes, the practical measure is no longer whether access can be granted, but whether it can be removed or replaced fast enough when identity state changes. That is where many identity programmes still expose the cloud estate to stale access and recovery drag.

Credential governance debt: the longer teams tolerate spreadsheets, manual exception handling, and delayed remediation, the more cloud access management turns into a compounding operational liability. For practitioners, the signal is clear: focus on the weakest credential path, because that path determines breach window, audit readiness, and recovery effort.

For practitioners

• Audit spreadsheet-held credentials Find every place cloud passwords or application credentials are stored outside governed systems, then assign owners and removal deadlines for each location.
• Map lifecycle closure points Document where joiner, mover, and leaver events do not reach cloud admin planes, especially for contractors, temporary workers, and delegated admins.
• Measure recovery time for compromised passwords Test how long it takes to replace a compromised cloud credential from detection through full revocation, including emergency access paths and fallback authentication.
• Review rogue-account removal workflows Check whether detection of an unauthorised account is manual, scripted, or automated, and whether the process reaches all cloud environments consistently.

Key takeaways

• Cloud access management fails most often when credential handling and lifecycle control lag behind the pace of change in multi-cloud estates.
• The article reports that 49% of teams used spreadsheets for cloud passwords, 75% managed application credentials this way, and 70% could not remediate compromised or non-compliant passwords within 24 hours.
• The practical response is to govern the full access lifecycle, including recovery, revocation, and fallback authentication, rather than treating authentication as the whole problem.

Key terms

• Cloud Access Management: Cloud Access Management is the control of who can reach cloud services, what they can do, and under what conditions. It combines identity, policy, authentication, authorization, and session oversight across cloud platforms, applications, and infrastructure. Effective cloud access management reduces overprivilege, limits lateral movement, and supports auditability in dynamic environments.
• Joiner-mover-leaver flow: The lifecycle process that updates access as people or systems join, change role, or leave. For identity programmes, it is the mechanism that prevents rights from becoming stale and shared access from becoming unaccountable. Strong JML discipline is a continuous control, not a one-time onboarding task.
• Rogue Account: A rogue account is an identity that still has valid access even though the organisation no longer recognises it as authorised. For cloud programmes, that usually means a former user, contractor, or workload credential that was not revoked on time and can still be abused.
• Credential Recovery Time: Credential recovery time is the period between discovering a compromised secret and fully replacing or revoking it. In identity programmes, it is a practical measure of whether governance can keep pace with real-world compromise and whether backup access paths are equally controlled.

Deepen your knowledge

NHI governance, IAM, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.