Cloud security tools in 2025 expose the identity governance gap

At a glance

What this is: This is Cyera’s 2025 cloud security tools guide, and its central finding is that cloud security has become an identity and entitlement governance problem as much as a tooling problem.

Why it matters: It matters because IAM, CIEM, and cloud data security teams now have to govern who and what can access sensitive cloud data across multi-cloud estates, not just deploy more monitoring.

By the numbers:

• 25% of companies report IT downtime costs between $301,000 and $400,000 per hour.
• Breached accounts increased eightfold from 2023 to over 5.5 billion in 2024.

Context

Cloud security tools now sit at the intersection of infrastructure protection, data governance, and identity control. The article’s core point is that perimeter-era assumptions no longer hold in multi-cloud environments, where access paths, data movement, and entitlement sprawl have become the real governance problem.

For IAM and NHI practitioners, the important shift is that cloud controls are no longer just about monitoring misconfigurations or stopping malware. They increasingly have to answer who can access what, whether those entitlements are justified, and whether cloud data protections are aligned with how identities actually operate across platforms.

Key questions

Q: How should security teams govern cloud entitlements across multiple clouds?

A: Security teams should normalize entitlements across providers, review effective access rather than raw policy text, and enforce least privilege through recurring remediation. The key is to connect entitlement discovery to ownership, approval, and removal workflows so excess access does not survive as environment drift. Treat cross-cloud consistency as a governance requirement, not a reporting preference.

Q: Why do cloud security programmes need CIEM and DSPM together?

A: Because permissions and data exposure are different views of the same risk. CIEM shows who can reach cloud resources, while DSPM shows which sensitive datasets are actually worth protecting. If teams only do one, they either miss who has access or miss what that access can reach.

Q: What breaks when cloud identities are not centrally governed?

A: Shadow accounts, orphaned credentials and inconsistent role definitions emerge because no single process can see the whole access picture. That breaks least privilege, complicates incident response and makes compliance evidence harder to prove, especially when workforce and service identities are managed separately.

Q: When should organisations prioritise identity and authorization capabilities over broader security tooling?

A: Organisations should prioritise identity and authorization capabilities when remote work, SaaS sprawl, and expanding tech stacks make access control the main pressure point. If the security problem is who can reach systems and data, identity-centric controls often deliver faster risk reduction than adding more perimeter-focused tooling or point products.

Technical breakdown

Why CIEM has become central to cloud identity governance

Cloud Infrastructure Entitlement Management, or CIEM, exists to audit and govern permissions across multi-cloud environments. In this article, Cyera places CIEM alongside the broader cloud stack because overprivileged accounts and entitlement drift are now core exposure points, not side issues. CIEM is most useful when cloud teams need visibility into effective permissions across accounts, subscriptions, projects, and roles, then need to align those permissions with least privilege and policy expectations. The key architectural point is that cloud access is dynamic and distributed, so entitlement review has to happen continuously rather than as a one-time provisioning exercise.

Practical implication: Treat entitlement review as a continuous control, not a periodic cleanup exercise.

How DSPM and CIEM split the cloud governance problem

DSPM and CIEM solve different halves of the cloud risk equation. DSPM discovers and classifies sensitive data, maps where it moves, and shows who can reach it. CIEM focuses on the permissions and roles that make that access possible. The article’s architecture matters because many cloud programmes try to protect data without understanding entitlement paths, or manage entitlements without knowing which datasets are actually exposed. In practice, those gaps leave teams unable to prove whether access is both necessary and justified. Cloud data governance only works when data location, data sensitivity, and identity permissions are correlated.

Practical implication: Correlate sensitive data discovery with entitlement analysis before deciding where to enforce controls.

Why API and workload security still depend on identity boundaries

The article also shows that cloud attack surfaces are now identity-shaped across APIs, workloads, and managed services. API security depends on authentication, authorization, inventory, and anomaly detection, while CWPP and container security depend on controlling runtime behavior and access in DevOps pipelines. Those capabilities matter because cloud services do not fail in isolation. They fail when identities, tokens, roles, and service access are too broad or too persistent for the workload they support. That is why cloud security architecture increasingly has to model identity boundaries inside every layer, from APIs to Kubernetes to data access paths.

Practical implication: Design cloud controls around identity boundaries, not only around network or workload boundaries.

NHI Mgmt Group analysis

Cloud security in 2025 is really identity governance by another name. The article’s taxonomy shows that modern cloud stacks are no longer separable into neat infrastructure, application, and data layers. Entitlement management, access policy, and identity context now determine whether the rest of the stack is governable at all. For practitioners, the cloud security programme has shifted from protecting platforms to governing effective access across those platforms.

CIEM is the control category that makes the cloud identity problem visible. The guide correctly places overprivileged accounts and entitlement auditing at the center of cloud security because cloud permissions accumulate faster than most review cycles can absorb. That makes entitlement drift the practical governance issue, not just misconfiguration. Teams should read CIEM as a governance function that converts sprawling cloud access into something reviewable, defensible, and policy-aligned.

Cloud data security fails when identity and data discovery are treated as separate disciplines. DSPM can tell you where sensitive data lives and CIEM can tell you who can reach it, but neither is complete on its own. The gap between those two views is where cloud exposure hides. The practitioner lesson is that access governance and data classification have to be correlated if cloud policy is going to be enforced in any meaningful way.

Cloud security tooling is converging on a control plane that spans IAM, APIs, and runtime access. The article’s own structure reflects the market direction: more categories, but also more overlap around identity, authorization, and response. That convergence validates zero-trust architecture in cloud programmes, but it also complicates ownership because no single team can govern data, workload, and entitlement risk in isolation. Practitioners should expect cloud security operating models to become more cross-functional, not more siloed.

Identity blast radius is now the most important cloud security metric. Once access spans multiple providers, managed services, and automated workflows, the question is no longer whether a control exists but how far a compromised or excessive entitlement can travel. That is why cloud security maturity increasingly depends on shrinking effective privilege, not just detecting misuse after the fact. The practical conclusion is to measure how much damage an identity can do before you measure how many alerts a tool can generate.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: Ultimate Guide to NHIs — Standards

What this signals

Identity blast radius: cloud security programmes now need a way to measure how far one identity can travel across accounts, services, and datasets. When that reach is large, the control problem is not detection alone but reducing the permissions that make spread possible.

Cloud security teams should expect entitlement review, data classification, and runtime enforcement to converge into one governance workflow. The operational question is no longer whether a tool can see a misconfiguration, but whether the programme can prove who can touch sensitive data and under what authority.

For practitioners

• Map cloud entitlements to real data access Correlate CIEM output with DSPM findings so you can see which identities actually reach sensitive cloud data, not just which roles exist on paper.
• Review overprivileged cloud accounts continuously Use entitlement audits to identify roles and service access that exceed business need, then shorten the review cycle for high-risk permissions.
• Separate data discovery from access enforcement Classify sensitive data first, then validate the identity paths that reach it before you decide where to apply prevention or monitoring controls.
• Tune cloud controls to identity boundaries Check APIs, workloads, and Kubernetes access for excessive authorization scope so runtime protections align with the identities that actually operate those services.
• Measure identity blast radius Track how far a single cloud identity can move across accounts, services, and datasets, and use that exposure profile to prioritise remediation.

Key takeaways

• Cloud security has moved beyond perimeter protection into entitlement governance, because cloud risk now follows identities and access paths.
• The article’s own taxonomy shows that CIEM and DSPM are complementary, with one governing permissions and the other exposing sensitive data reach.
• Practitioners should measure identity blast radius and align cloud access with data sensitivity before adding more monitoring layers.

Key terms

• Cloud Infrastructure Entitlement Management: Cloud Infrastructure Entitlement Management focuses on who has access to what in cloud systems, especially excessive or unused permissions. It helps reveal overprivileged identities, but it does not automatically remove them. In practice, it is most useful when tied to policy enforcement and access expiry mechanisms.
• Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Shared Responsibility Model: A shared responsibility model divides security duties between the cloud provider and the customer. For NHI governance, the provider supplies the platform controls, but the organisation still owns configuration, privilege review, secret handling, monitoring, and lifecycle management of its identities.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.