Topic starter
02/08/2026 11:53 am
TL;DR: KiranaPro’s cloud environment was wiped after attackers used a former employee’s account to delete AWS and GitHub infrastructure, demonstrating that provider-native controls and MFA do not stop account abuse when offboarding and monitoring are weak, according to Exaforce. The breach shows why access governance and runtime visibility must be treated as operational controls, not documentation exercises.
Editorial analysis by NHI Mgmt Group, based on content published by Exaforce: “The KiranaPro breach: A wake-up call for cloud threat monitoring”.
Key questions
Q: What breaks when former employee access is not revoked in cloud environments?
A: The account can remain a live attack path long after the person has left, especially if it still has administrative or automation-related permissions.
Q: Why does MFA not stop every cloud account abuse scenario?
A: MFA protects the authentication step, but it does not fix stale access, over-privileged entitlements, or a valid account that should already have been closed.
Q: What are the signs that cloud threat monitoring is too passive?
A: If teams only see alerts for misconfigurations and not for real user behaviour such as mass deletion, sudden permission changes, or logins from unusual locations, monitoring is too passive.
Practitioner guidance
- Tighten former-employee account revocation Create a hard offboarding workflow that revokes cloud, GitHub, and adjacent SaaS access immediately, then checks for dependent service use before closure.
- Monitor destructive cloud actions in real time Alert on mass deletions, privilege changes, unusual logins, and access from unexpected locations across AWS, GitHub, and other critical SaaS tools.
- Reduce standing privilege in cloud and code platforms Scope administrative access tightly and remove persistent high-risk permissions from accounts that do not need them every day.
Bottom line: The KiranaPro breach shows that former employee access can become a high-impact cloud attack path when offboarding is incomplete.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:02 pm
Offboarding is now a cloud attack control, not an HR task. The KiranaPro breach shows that stale employee access can become a direct path to destructive cloud activity when revocation is incomplete. In identity programmes, offboarding has to be treated as an enforcement event with dependency checks, not an administrative close-out. Practitioners should treat delayed deprovisioning as a live attack surface.
A question worth separating out:
Q: How should cloud and IAM teams respond when a former employee account is still active?
A: Treat it as an incident-ready access gap, not an administrative oversight. Revoke the account, review its privileges, check for dependent automations or integrations, and verify whether the account was used after departure. The objective is to close the access path without breaking legitimate production dependencies.
👉 Read our full editorial: KiranaPro breach exposes cloud threat monitoring and offboarding gaps