TL;DR: Cloud security in 2026 is shifting toward identity, data, and workload governance rather than perimeter defense, with Sentra stressing shared responsibility, least privilege, CSPM, encryption, and continuous monitoring as cloud and multi-cloud estates expand. The core issue is not just misconfiguration but whether access, configuration, and data controls can keep pace with dynamic cloud operations.
At a glance
What this is: This is a cloud security analysis arguing that 2026 risk is increasingly shaped by identity control, data protection, and configuration governance rather than perimeter defence.
Why it matters: It matters because IAM, PAM, and cloud security teams need to govern access, workload permissions, and data exposure together as cloud estates scale.
By the numbers:
- Sentra says cloud storage costs can typically be reduced by approximately 20% by eliminating shadow and ROT data.
Context
Cloud security now hinges on how identities, permissions, and data exposure are governed inside distributed cloud environments. The perimeter no longer defines risk on its own, because access decisions, configuration drift, and workload sprawl all create exposure paths that traditional network-first models do not see.
The shared responsibility model still matters, but it shifts the practical burden to the customer for access control, configuration, and data protection. That makes identity governance, workload access review, and continuous posture monitoring central to cloud security programmes, especially where multi-cloud and AI-ready data use cases amplify the attack surface.
Key questions
Q: What breaks when cloud security is still built around a fixed network perimeter?
A: A fixed perimeter breaks down when workloads, data, and applications move across hybrid and multi-cloud environments. Security teams lose coverage during transit, temporary storage, and rapid scaling events, which creates blind spots for attacks and policy drift. The result is inconsistent protection, weaker visibility into communication paths, and a higher chance that cloud activity escapes traditional controls.
Q: Why do over-privileged cloud entitlements increase breach impact?
A: They increase breach impact because a stolen credential or compromised integration can inherit far more access than the underlying task requires. That turns a single identity into a broad attack path for data access, configuration changes, and persistence, especially when permissions are inherited through roles and group membership.
Q: What are the signs that cloud posture management is not enough on its own?
A: If CSPM findings keep surfacing while access reviews, role design, and workload permissions remain broad, the programme is only seeing half the problem. Another sign is when configuration issues are fixed but the same identities still have reach into sensitive data or critical services. That means posture detection is working better than entitlement governance.
Q: How should security teams govern AI data access without slowing the business down?
A: Security teams should define policy around data context, not around static folders or file names. The practical model is continuous discovery, high-confidence classification, and automated enforcement that limits risky access while preserving approved AI use cases. If controls require manual review for every exception, they will fail at AI scale.
Technical breakdown
Shared responsibility turns identity into a control plane
In cloud environments, the provider secures the underlying infrastructure, but the customer controls identity, configuration, and data access. That split makes identity the practical control plane for cloud security because every meaningful action, from accessing a storage bucket to calling a cloud API, is mediated by permissions. When permissions are broad, stale, or hard to audit, the control model fails even if infrastructure is well managed. The article's emphasis on least privilege and role-based access reflects a basic cloud reality: security breaks where authorisation is too loose or too hard to verify.
Practical implication: Treat identity governance as a cloud control requirement, not a separate IAM exercise.
CSPM detects misconfigurations, but not all access risk
Cloud Security Posture Management scans environments for risky settings, exposed services, and drift from policy. That helps detect configuration errors, but it does not fully solve access governance because a correctly configured resource can still be reached by an overprivileged identity. In other words, posture management finds exposed doors, while identity controls determine who has the key. The article's focus on continuous review, encryption, and access policies shows that configuration and identity must be governed together, especially where workloads are created and destroyed quickly.
Practical implication: Pair CSPM findings with entitlement reviews so configuration and access failures are remediated together.
Data governance in cloud now includes AI-readiness and access tracing
The article links cloud security to AI-ready data governance, which means teams must know where sensitive data lives, how it moves, and who can access it. That is more than storage protection. It is a governance problem spanning classification, lineage, access scope, and the limits of in-environment processing. For identity teams, the key intersection is that data access must be tied to specific identities and use cases, not just broad platform roles. Without that traceability, AI use introduces extra exposure even when the underlying cloud controls appear sound.
Practical implication: Build identity-linked data access traceability before expanding AI use across cloud environments.
Threat narrative
Attacker objective: The attacker aims to reach sensitive cloud data or workloads through weak access and configuration controls, then use that reach to cause exposure or operational damage.
- Entry occurs when cloud resources, APIs, or data stores are exposed through permissive settings or excessive identity permissions rather than through a traditional perimeter breach.
- Credential or permission abuse follows when users, applications, or workloads retain more access than their tasks require, allowing unauthorised data retrieval or configuration changes.
- Impact emerges as sensitive data is exposed, governance assumptions fail, and teams lose confidence that cloud and AI-ready data can be safely used at scale.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
- Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cloud security has become an identity governance problem because access, not perimeter location, now defines exposure. When workloads, users, and APIs all share the same cloud fabric, the decisive control is whether permissions are narrowly scoped and continuously reviewed. That changes cloud security from static hardening to ongoing authorisation governance, and practitioners should treat privilege drift as a first-order cloud risk.
Cloud security posture tooling finds misconfiguration, but it does not close the governance gap that overprivileged identities create. A resource can be perfectly configured and still be reachable through an identity with excessive rights. That makes the real failure mode a control split between posture detection and entitlement governance, so practitioners need both to understand whether access is actually justified.
AI-ready data governance introduces a new cloud security concept: the identity-linked data access boundary. Sensitive data can no longer be protected only by location or encryption state because modern cloud and AI workflows depend on tracing who can access which data, for what purpose, and through which workload. That boundary needs to be explicit if organisations want cloud AI use without uncontrolled data reach.
Least privilege is no longer a policy ideal in cloud environments, it is the mechanism that limits blast radius across distributed services. As organisations scale across SaaS, PaaS, and IaaS, broad role assignment becomes the hidden source of operational and regulatory risk. Practitioners should view privilege scope as a measurable governance boundary and not as a generic best practice.
Shared responsibility only works when the customer side is operationalised into identity, data, and configuration controls. Cloud providers can secure the substrate, but they cannot decide whether your identities are overbroad or your data is classified correctly. The practical conclusion is that cloud security programmes must define who owns access reviews, data controls, and posture remediation before scale introduces control gaps.
From our research library:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Read next: NHI Lifecycle Management Guide
What this signals
Identity-linked cloud governance: cloud programmes now need an explicit boundary between platform configuration and identity authorisation, because one can look compliant while the other remains dangerously broad. That boundary is where cloud risk becomes operationally manageable.
Teams should expect posture tooling to expose the settings, but not the ownership model, behind cloud exposure. The harder problem is proving that each access path is justified, reviewed, and tied to a specific workload or business use case.
Sentra's emphasis on visibility aligns with a broader cloud security truth: misconfiguration alone is only half the problem. The other half is whether the identities that can exploit those settings are continuously governed.
For practitioners
- Implement identity-centred cloud governance Map every cloud workload, human user, and service account to an explicit owner, scope, and review cadence so access decisions are traceable.
- Bind CSPM findings to entitlement review Require every misconfiguration finding to be checked against the identities that can exploit it, then remediate configuration and access together.
- Classify and trace sensitive data in cloud Maintain live data classification and lineage so teams can see where sensitive data sits, how it moves, and which identities can reach it.
- Enforce least privilege across cloud service models Separate access patterns for SaaS, PaaS, and IaaS so permissions match the control level users actually have in each service model.
- Test shared responsibility ownership Document who owns configuration, access, monitoring, incident response, and recovery for each cloud platform before scaling workloads further.
Key takeaways
- Cloud security now fails most often at the point where identity scope, configuration drift, and data access intersect.
- Misconfiguration tools help, but they do not replace entitlement governance or prove that access is justified.
- Practitioners should tie cloud posture findings to owner-specific access reviews so exposure is reduced at the control layer that actually creates it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on cloud access scope and entitlement governance. |
| Recommendation — Apply PR.AA-05 to keep cloud permissions narrowly scoped and continuously reviewed. | ||
| CIS Controls v8 | CIS-5 — Account Management | Cloud identity review and least privilege are central to the article's risk model. |
| Recommendation — Use CIS-5 to formalise cloud account ownership, review, and removal of excess access. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is a primary control theme across the article's cloud governance advice. |
| Recommendation — Enforce AC-6 so cloud users and workloads receive only the permissions required for each task. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The cloud security model in the article depends on governing identity and access across services. |
| Recommendation — Map cloud access governance to IAM controls so identity scope is reviewed across cloud services. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article's breach pattern is access abuse through cloud tokens and overbroad permissions. |
| Recommendation — Map exposed cloud tokens and overprivileged accounts to TA0006 and TA0008 in threat detection. | ||
Key terms
- Shared Responsibility Model: A shared responsibility model divides security duties between the cloud provider and the customer. For NHI governance, the provider supplies the platform controls, but the organisation still owns configuration, privilege review, secret handling, monitoring, and lifecycle management of its identities.
- Cloud Security Posture Management: Cloud Security Posture Management is a set of tools and processes that identify misconfigurations, policy drift, and exposure in cloud environments. It is strongest at discovery and weakest at enforcement, so it should be treated as a detection layer that feeds remediation rather than a control plane that changes access by itself.
- Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
- AI-Ready Governance: A governance approach that treats enterprise content as a controlled input to AI systems, not just as stored information. It requires classification, access control, retention discipline, and policy enforcement before data can be reused by copilots, retrieval systems, or automated workflows.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect access governance to the broader control decisions their programmes depend on.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org