Cloud security is exposing identity gaps across multi-cloud estates

At a glance

What this is: This is a cloud security analysis showing that multi-cloud growth, AI adoption, and exposed workloads are making identity, privilege, and lifecycle control the limiting factors.

Why it matters: IAM, PAM, and NHI teams need to treat cloud security as an identity governance problem because unmanaged access and weak entitlement control multiply blast radius across every cloud provider.

By the numbers:

• 55% of organisations use two or more cloud providers.
• 84% use AI in the cloud.
• 62% have at least one vulnerable AI package.

Context

Cloud security is the set of controls that protect cloud data, applications, infrastructure, and identities. In this article, the central problem is not cloud scale by itself but the governance gap that appears when identity, privilege, and lifecycle control have to span multiple cloud providers, AI services, and fast-changing workloads.

Orca Security’s report frames that gap around multi-cloud sprawl, vulnerable AI packages, and neglected assets. For IAM and NHI teams, the important question is whether access, entitlement, and offboarding processes still work when environments are distributed, ephemeral, and increasingly machine-driven.

The article also shows that cloud security is no longer just about perimeter control or misconfiguration detection. It is about whether organisations can maintain a reliable inventory of who and what can act in the environment, and whether standing privilege is being replaced with governed, task-scoped access.

Key questions

Q: How should security teams govern identity and configuration risk across multi-cloud environments?

A: Security teams should treat multi-cloud governance as a single operating problem, not a collection of isolated cloud projects. The practical goal is consistent policy, centralized visibility, and risk prioritization across every provider. That means inventorying assets, mapping identity and configuration exposure, and focusing remediation on the attack paths most likely to create real compromise or compliance impact.

Q: Why do standing cloud permissions increase attack paths?

A: Standing permissions increase attack paths because they remain usable long after the original business need has passed. In a cloud estate, that persistence lets attackers reuse legitimate access to reach more data, more workloads, and more control planes. The longer the access stays live, the more opportunities there are for abuse.

Q: What are the signs that non-human identity governance is failing in cloud environments?

A: Common warning signs include credential sprawl, long-lived API keys, unrotated certificates, unclear ownership, and workloads with more access than they need. Another red flag is when teams cannot quickly show who or what accessed a resource, or when access decisions are still handled manually. Those symptoms usually point to weak visibility, weak policy enforcement, or both.

Q: Should teams prioritise AI security posture or cloud identity controls first?

A: They should treat them as the same control problem when AI workloads run in cloud environments. Securing the package without constraining its identity leaves access risk in place, while tightening identity without understanding the model and dependency chain leaves operational blind spots. The right sequence is to govern both together.

Technical breakdown

Why multi-cloud breaks centralised identity control

Multi-cloud estates fragment identity governance because each provider, account model, and service boundary introduces its own permissions, roles, and audit surfaces. When organisations manage access across AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, and Kubernetes from separate consoles, entitlement drift becomes normal. The issue is not simply visibility. It is that consistent policy enforcement becomes harder as resources, roles, and workloads multiply. Cloud security tools can aggregate data, but they cannot by themselves make privilege consistent across every tenant and runtime.

Practical implication: unify entitlement inventory and policy logic before privilege drift becomes an unbounded governance problem.

How vulnerable AI packages expand the cloud identity surface

AI packages in cloud environments are not only a software supply concern. They also create identity and access consequences because models, dependencies, and cloud services often require tokens, service accounts, or broad platform permissions to function. Once AI is embedded into production workflows, its access scope can outgrow the control model that originally approved it. That is why AI security posture and cloud identity posture are converging. The cloud security challenge is not just to find risky packages, but to govern what those packages can reach once deployed.

Practical implication: bind AI workloads to narrowly scoped credentials and review their access scope as part of deployment governance.

Why least privilege needs runtime enforcement in cloud environments

Least privilege in the cloud cannot be treated as a one-time role design exercise. The article points to just-in-time access and AI-driven IAM because standing privileges persist longer than most cloud tasks need them to. In dynamic environments, a permission that is reasonable at provisioning time may become excessive minutes later as workloads scale, auto-schedule, or fail over. Runtime enforcement matters because attack paths are created by what remains available, not only by what was originally granted.

Practical implication: move high-risk cloud access to just-in-time issuance and continuously retire standing permissions that are no longer needed.

NHI Mgmt Group analysis

Cloud security has become an identity governance problem before it is a tooling problem. The article’s own evidence shows that cloud estates are now defined by multi-provider complexity, AI adoption, and long-lived access paths. That combination pushes governance decisions into IAM, PAM, and NHI lifecycle control rather than leaving them in posture-only tooling. Practitioners should treat cloud security as the operational management of who or what can act, not just what is exposed.

Standing privilege is the cloud’s most persistent blast-radius multiplier. Neglected workloads, exposed databases, and vulnerable AI packages are dangerous because they remain reachable by identities that were not designed for today’s runtime. A permission model that tolerates persistent access widens every misconfiguration into a faster compromise path. The practical conclusion is that access duration now matters as much as access scope.

AI in the cloud collapses the old boundary between application risk and identity risk. When 84% of organisations use AI in the cloud, the permission boundary around the model, its dependencies, and its data becomes part of the security problem. That means cloud security teams cannot separate AI posture from identity posture without leaving a gap in governance. Practitioners need to govern the access path as carefully as the workload itself.

Ephemeral cloud resources make recertification insufficient unless issuance is controlled. Containers, serverless functions, and fast-moving workloads often exist for less time than an access review cycle. That means governance processes built around periodic review miss the moment when access becomes excessive. The article reinforces a shift toward control at issuance time and away from relying on later review alone.

Cloud security now depends on reducing the number of reachable attack paths, not just the number of findings. The report’s discussion of attack paths shows why raw vulnerability counts are an incomplete measure of risk. What matters is whether identities, permissions, and exposed assets combine into a path to crown-jewel resources. Practitioners should measure cloud security by path reduction and privilege containment.

From our research library:

• Valid account abuse was responsible for 35% of cloud-related incidents, according to CrowdStrike's 2025 Global Threat Report.

What this signals

Cloud programmes are now judged by whether identity governance keeps pace with workload sprawl. The practical shift is from finding every asset to proving that every asset has a valid, least-privilege identity behind it.

Identity blast radius: multi-cloud access models enlarge the number of places where a single over-permissioned identity can become a cross-environment control failure. That makes entitlement reduction and access expiry more important than adding another layer of detection.

Security leaders should expect cloud and AI governance to converge further as model dependencies, service accounts, and deployment pipelines become part of the same trust boundary. The programme question is no longer whether cloud is visible, but whether its identities are governable at runtime.

For practitioners

• Map cloud entitlements across every provider Create a single inventory of cloud roles, service accounts, tokens, and workload permissions across all active cloud platforms. Prioritise identities that span multiple accounts or environments because they tend to accumulate unmanaged access fastest.
• Convert standing access to just-in-time access Reserve persistent permissions for only the smallest set of break-glass use cases. For routine cloud operations, issue time-bound access with explicit approval and automatic expiry so permissions do not outlive the task.
• Bind AI workloads to least-privilege credentials Treat AI packages and model-integrated services as access-bearing identities. Restrict their tokens and service accounts to the minimum resources they need, and review those grants whenever dependencies or deployment patterns change.
• Track neglected assets and unpatched workloads Use continuous discovery to flag cloud assets that are abandoned, unmanaged, or running unsupported software. Tie remediation to exploitability and runtime reachability so the highest-risk assets are fixed first.
• Measure attack paths to crown-jewel resources Prioritise cloud findings by whether they create a path to sensitive databases, privileged workloads, or production control planes. Use path analysis to decide which misconfigurations and identities must be remediated first.

Key takeaways

• Cloud security exposure in this article is driven less by raw cloud adoption than by the difficulty of governing identity, privilege, and lifecycle across multiple providers and AI workloads.
• The report points to 55% multi-cloud use, 84% cloud AI adoption, 62% vulnerable AI packages, and nearly a third of assets neglected or unpatched as evidence of growing operational strain.
• The control answer is to reduce standing privilege, bind AI and workload access to least privilege, and focus remediation on the attack paths that reach crown-jewel resources.

Key terms

• Cloud Security Posture Management: Cloud Security Posture Management is a set of tools and processes that identify misconfigurations, policy drift, and exposure in cloud environments. It is strongest at discovery and weakest at enforcement, so it should be treated as a detection layer that feeds remediation rather than a control plane that changes access by itself.
• Cloud Infrastructure Entitlement Management: Cloud Infrastructure Entitlement Management focuses on who has access to what in cloud systems, especially excessive or unused permissions. It helps reveal overprivileged identities, but it does not automatically remove them. In practice, it is most useful when tied to policy enforcement and access expiry mechanisms.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Attack path: A sequence of identities, permissions, systems, and data stores that an attacker can traverse after obtaining trusted access. In practice, attack paths matter more than single accounts because they show how a low-risk identity can become a route to high-value exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.