TL;DR: Nearly 40% of organisations reported security or compliance incidents tied to governance gaps introduced during cloud migration, according to Pathlock’s 2025 Digital Transformation & Access Risk Report. The findings show that transformation programmes are still outpacing GRC planning, leaving access reviews, SoD checks, and deprovisioning too manual to contain risk.
At a glance
What this is: Pathlock’s report says cloud migration is widening governance gaps, with nearly 40% of organisations reporting security or compliance incidents tied to those gaps.
Why it matters: IAM, IGA, and PAM teams need to treat migration as a governance redesign problem because manual reviews, delayed offboarding, and weak SoD checks quickly create audit and insider risk.
Context
Cloud migration changes where access is managed, where approvals are enforced, and where governance evidence is produced. In hybrid environments, the problem is not only technical integration but the timing gap between migration work and GRC design, especially when regulated data and business-critical processes move before controls are updated.
Pathlock’s report frames this as a modernisation risk pattern rather than a product issue: 620 enterprise IT, compliance, and security leaders were surveyed across manufacturing, financial services, healthcare, and government. The common failure mode is treating governance as something to retrofit after systems and roles have already changed.
Key questions
Q: What breaks when cloud migration starts before governance is redesigned?
A: Access reviews, SoD checks, and deprovisioning break first because they depend on a stable role and entitlement model. When migration changes business processes before governance is updated, teams certify the wrong access state and create audit gaps, insider risk, and compliance exposure that only appear after the new model is already in use.
Q: Why does delayed GRC planning increase compliance risk during migration?
A: Delayed GRC planning lets operational teams redesign systems, roles, and data flows before control owners define review points and approval logic. That creates a window where regulated access exists without current oversight, which is why audit failures and compliance violations often surface after transformation work is already underway.
Q: How do teams know whether access governance is keeping pace with cloud migration?
A: Look for shortened review backlogs, SoD revalidation after every role change, and measured termination-to-revocation latency across connected systems. If those signals lag migration milestones, governance is no longer aligned to the live environment and is likely certifying stale access.
Q: What should organisations do when access offboarding still takes more than a day?
A: Treat slow offboarding as a governance defect, not an admin delay. The practical response is to automate revocation triggers across cloud and on-premises systems, then monitor whether access removal happens fast enough to prevent post-termination misuse and audit exceptions.
Technical breakdown
Why cloud migration breaks manual access governance
Cloud migration changes the identity surface faster than manual governance teams can track it. As ERP and enterprise systems move across cloud and on-premises boundaries, role definitions, entitlements, and approval paths change at different speeds. That creates a lag where access reviews, Segregation of Duties checks, and provisioning decisions no longer reflect the current control environment. The practical result is that governance evidence becomes stale before it is reviewed, which is why transformation programmes often look compliant on paper but remain weak in execution.
Practical implication: map migration milestones to access governance redesign so reviews and SoD checks are updated before role changes go live.
Why delayed GRC planning amplifies compliance risk
Governance, risk, and compliance planning has to be part of migration architecture, not a post-migration cleanup task. When teams redesign finance, HR, supply chain, or procurement processes without embedding control requirements early, they create a control gap between operational change and policy enforcement. That gap is visible in the report’s findings on late GRC updates and incomplete SoD checks. In practice, the problem is not that controls do not exist. It is that they are introduced after the new access model is already in production, which weakens accountability and auditability.
Practical implication: require GRC sign-off before role redesign or system cutover, not after users and entitlements have already shifted.
How manual offboarding extends exposure after termination
Manual deprovisioning is one of the clearest examples of governance lag during transformation. If access revocation takes more than a day, the former user, contractor, or service owner can still act inside business systems after the relationship has ended. In hybrid environments, that delay becomes more dangerous because the same identity may have influence across cloud and on-premises controls. The underlying issue is not only speed. It is the absence of lifecycle enforcement that keeps access aligned to employment and role changes as systems move.
Practical implication: automate termination-linked access revocation across cloud and on-premises systems and measure the elapsed time as a governance control.
Threat narrative
Attacker objective: The objective is to exploit control lag during transformation so excessive or stale access can be used without immediate governance detection.
- Entry occurs through migration-driven governance drift, where access and role changes happen before controls are redesigned to match the new environment.
- Credential or entitlement misuse follows when stale access, incomplete SoD checks, or delayed deprovisioning leave users with more authority than their current role requires.
- Impact emerges as compliance violations, insider fraud, and other security incidents surface during or after cloud migration.
Breaches seen in the wild
- Imperva breach 2019: An AWS API key stolen from an exposed Imperva test instance let an attacker copy Cloud WAF customer data, including API keys and SSL certificates.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cloud migration exposes a governance sequencing problem, not just a control gap. The report shows that many organisations redesign systems before they redesign entitlement governance, which means access models change faster than review and certification processes. That sequencing error turns migration into a period of elevated identity risk. Practitioners should treat cutover readiness as a governance milestone, not only a technical one.
Manual access governance becomes structurally unreliable once business functions are moving in parallel. When HR, finance, procurement, and supply chain systems transition at different speeds, access reviews and SoD checks lose the stable baseline they depend on. The result is a control environment that looks busy but cannot keep pace with role redesign. This is a lifecycle governance problem across human, application, and machine access paths.
GRC must be built into transformation design because post-hoc remediation is economically inefficient and operationally weak. The report’s findings on delayed controls, slow offboarding, and compliance violations show that governance is not a downstream assurance layer. It is part of the operating model that determines whether modernisation remains auditable. Teams that separate transformation from governance will keep paying for the same gap twice.
Governance readiness is now a board-level resilience issue, not an audit-only concern. The report links cloud migration gaps to compliance violations and insider fraud, which means the failure surface includes financial, operational, and reputational exposure. That broadens the case for IAM, IGA, and PAM alignment during transformation. The practitioner conclusion is simple: if control design trails migration, business risk becomes the default outcome.
Migration-era governance needs a named concept: access control drift. This is the period when roles, entitlements, and approval paths change faster than certification, SoD, and deprovisioning processes can be updated. Once drift becomes normal, the organisation is no longer governing the current state of access, only its last known version. Practitioners should measure how quickly governance catches up after each migration change.
What this signals
Access control drift: cloud migration creates a period where entitlement models, review cadences, and approval paths no longer describe the live business process. That drift is what turns modernisation into a governance problem, because the control stack lags the operating model instead of governing it.
When migration is treated as a system project instead of an access governance event, manual certification and delayed offboarding become predictable failure points. The practical lesson for IAM, IGA, and PAM teams is to shift control design left so governance is already aligned when the new environment goes live.
For practitioners
- Embed GRC before cutover Make governance design a formal prerequisite for every migration workstream, including role redesign, SoD analysis, and control ownership before production transition.
- Automate access reviews across hybrid estates Replace manual review cycles with automated access risk analysis and user access review workflows that cover both cloud and on-premises systems.
- Measure termination-to-revocation latency Track the elapsed time between termination events and access removal, then set a policy target that forces revocation across all connected environments.
- Re-test Segregation of Duties after role redesign Revalidate SoD rules whenever business roles, ERP structures, or procurement workflows change so inherited access does not survive the migration.
- Align insider-risk monitoring to migration windows Increase monitoring around periods when systems, roles, and approvals are being redesigned because that is when governance drift is most likely to surface.
Key takeaways
- Cloud migration exposes a predictable governance weak point when role design changes faster than access control processes can be updated.
- The report links this mismatch to security and compliance incidents, which means governance lag is already creating measurable operational risk.
- The most effective response is to embed GRC, SoD, and lifecycle enforcement into transformation planning before cutover begins.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Cloud migration governance gaps are fundamentally entitlements and authorization drift. |
| Recommendation — Apply PR.AA-05 to keep entitlements and authorizations aligned to live role changes during migration. | ||
| CIS Controls v8 | CIS-5 — Account Management | Slow offboarding and manual provisioning point directly to account lifecycle weakness. |
| Recommendation — Use CIS-5 to standardise account provisioning, review, and removal across migrated systems. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged Access Rights | Migration widens exposure when privileged access is not revalidated after role changes. |
| Recommendation — Reassess privileged access rights after each migration phase and remove unnecessary elevation. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The report's deprovisioning and governance timing issues depend on credential lifecycle enforcement. |
| Recommendation — Apply IA-5 to enforce credential lifecycle controls and revoke stale access promptly. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The delayed revocation problem maps directly to poor offboarding of non-human access paths. |
| Recommendation — Track and revoke non-human access when systems or ownership change to avoid offboarding drift. | ||
Key terms
- Role-Based Access Drift: Role-based access drift occurs when an identity continues to hold or use permissions that no longer match its job function. Over time, this creates blind spots in SaaS environments, where users can explore sensitive data, legacy applications, or privileged channels without triggering immediate suspicion.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- De-provisioning Latency: The delay between when access should end and when it is actually removed from systems. Short latency is critical in environments with seasonal hiring and high third-party involvement, because each extra hour of active access expands the chance of misuse or oversight failure.
- Governance Readiness: Governance readiness is the degree to which an organisation can apply policy, oversight, and accountability consistently in live operations. It depends on people understanding the systems they govern well enough to make decisions, review exceptions, and evidence control performance.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org