Notifications
Clear all
Topic starter
24/06/2026 6:49 pm
TL;DR: Cloud estates now hold thousands or even millions of permissions, and least privilege breaks down when human and non-human identities stay invisible across AWS, Azure, Google Cloud, SaaS, and legacy AD, according to Unosecur. The practical issue is not just access volume but whether teams can continuously see, score, and constrain it before it becomes audit debt or lateral movement risk.
NHIMG editorial — based on content published by Unosecur: A manager's six-step roadmap for secure access across cloud environments
By the numbers:
- Service accounts, API tokens and workload credentials now outnumber humans by as much as 50 : 1 in many organisations.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should security teams implement least privilege across multi-cloud environments?
A: Start with full identity visibility across human users, service accounts, API keys, tokens, and workload credentials.
Q: Why do non-human identities create more cloud risk than teams expect?
A: Non-human identities often carry durable credentials and broad permissions without the same review discipline applied to human users.
Q: What breaks when just-in-time access is not tied to cloud operations?
A: Standing admin rights remain available for attackers, auditors see a larger privilege surface, and temporary elevation becomes an exception rather than a control.
Practitioner guidance
- Build a full identity inventory Map every human and non-human identity across AWS, Azure, Google Cloud, SaaS, and legacy AD, then attach owner, business context, and privilege scope to each record.
- Replace standing admin with JIT elevation Require task-scoped elevation for privileged cloud work, pair it with step-up MFA, and make expiration automatic so access does not persist after the job is done.
- Rotate and retire durable secrets Automatically rotate service account keys and API tokens, prefer short-lived credentials, and block new long-lived keys where cloud platforms allow it.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- The exact sequencing of visibility, role right-sizing, JIT, and review controls across multi-cloud estates.
- How the platform maps human and non-human identities to business context for risk-ranked approvals.
- The mechanics of automated secret rotation and cloud-native policy enforcement across AWS, Azure, and Google Cloud.
- How identity-centred ITDR handles noisy alerts and risky grants in day-to-day operations.
👉 Read Unosecur's roadmap for secure access across cloud environments →
Cloud identity visibility and JIT access: what teams need now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 3:46 am
Least privilege is now an identity visibility problem before it is a permissions problem. Cloud programmes rarely fail because the principle is wrong. They fail because teams cannot see every human and non-human identity well enough to rank, certify, and constrain access in real time. That makes inventory quality the first control plane, not a reporting exercise. Practitioners should treat discovery completeness as the gate to every downstream IAM decision.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Another finding from that survey shows that only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
A question worth separating out:
Q: Who is accountable for over-privileged service accounts and stale secrets?
A: Accountability should sit with the identity or platform owner who can prove why the access exists, how long it should live, and when it will be removed. Frameworks such as NIST CSF and OWASP NHI both expect ownership, lifecycle control, and evidence that access is being reduced over time.
👉 Read our full editorial: Least privilege across cloud environments needs identity visibility
