Notifications
Clear all
Topic starter
20/08/2026 5:54 pm
TL;DR: Cloud security failures often come from enforceable controls being skipped, fragmented, or applied too late, according to Xygeni. The practical lesson is that cloud security is really a lifecycle problem across identity, secrets, IaC, CI/CD, and build integrity, where drift and standing access create the conditions for compromise.
NHIMG editorial — based on content published by Xygeni: Cloud security tips are only useful when they address the real gaps attackers exploit
By the numbers:
- The 2024 Shai-Hulud campaign compromised 830+ npm packages.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: What breaks when cloud identities are not centrally governed?
A: Shadow accounts, orphaned credentials and inconsistent role definitions emerge because no single process can see the whole access picture.
Q: Why do static credentials create more risk than ephemeral access for cloud admins?
A: Static credentials create standing privilege, which means one leak can remain usable until someone finds and revokes it.
Q: How do security teams know whether cloud access policy is actually working?
A: They should test whether policy decisions are traceable from discovery to approval to revocation.
Practitioner guidance
- Implement fixed-cycle reviews for machine identities Review service accounts, CI/CD runners, and workload identities on a fixed cadence, then remove permissions that are no longer tied to an active workload or deployment path.
- Replace static secrets with short-lived credentials Move cloud and pipeline access to ephemeral tokens wherever possible, and require rotation plus revocation workflows for any credential that cannot be eliminated.
- Enforce policy-as-code in the delivery pipeline Block deployments that introduce privileged containers, open network paths, or wildcard IAM grants by making the policy check part of every pull request and build.
What's in the full article
Xygeni's full article covers the operational detail this post intentionally leaves for the source:
- Layer-by-layer control examples for identity, data, infrastructure, supply chain, and incident response.
- Concrete workflow guidance for enforcing policy as code inside pull requests and CI/CD gates.
- Runtime and build visibility patterns that help teams spot compromise before it reaches production.
- Implementation-oriented breakdowns of secrets handling, artifact signing, and runner hardening.
👉 Read Xygeni's cloud security tips for identity, secrets, and pipeline controls →
Cloud security tips and the governance gaps teams keep missing?
Explore further
20/08/2026 6:35 pm
Cloud security is really an identity governance problem when machine access is part of the delivery chain. The article correctly places least privilege, short-lived credentials, and JIT access at the centre of cloud defence because modern cloud attacks often begin with an identity that was created for automation and then left to accumulate trust. For IAM and PAM teams, the practical conclusion is that machine access must be governed as tightly as human privileged access.
A question worth separating out:
Q: Should organisations prioritise cloud identity controls before adding more scanners?
A: Yes, when the main risk is exposed access rather than unknown malware. Scanners help, but they do not stop a permissive role, a valid token, or an over-privileged runner from being abused. Identity and privilege controls usually provide the biggest reduction in blast radius because they narrow what an attacker can do after initial access.
👉 Read our full editorial: Cloud security tips fail when identity and pipeline controls drift
