Notifications
Clear all
Topic starter
10/06/2026 9:47 pm
TL;DR: Cloud security posture management tools can improve visibility into cloud misconfigurations and risky entitlements, but they do not solve the identity governance problems created by over-privileged access, delayed remediation, and fragmented multi-cloud control, according to Zluri. The practical issue is that posture visibility without lifecycle discipline still leaves security teams exposed to access sprawl and missed containment opportunities.
NHIMG editorial — based on content published by Zluri: IT Teams 8 Lacework Alternatives For Cloud Security [2026 Updated]
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should security teams govern cloud identities when using CSPM tools?
A: Security teams should use CSPM to identify risky configurations, then connect each finding to an owning identity, approval trail, and revocation process.
Q: Why do cloud posture tools still leave identity risk unresolved?
A: Because posture tools are built to detect misconfiguration, not to govern the lifetime of the credentials that create access.
Q: What do IAM teams get wrong about multi-cloud security?
A: They often treat multi-cloud risk as a discovery problem when it is also an entitlement and offboarding problem.
Practitioner guidance
- Inventory every cloud identity alongside its owning system Tie each alerting source to the underlying service account, token, certificate, or integration it represents.
- Review standing cloud entitlements before buying more detections Prioritise access reviews for the most reused cloud roles, especially where the same credentials touch production, analytics, and SaaS connectors.
- Link posture findings to lifecycle workflows Route high-risk misconfigurations into rotation, offboarding, and recertification processes so findings do not sit in a queue.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Side-by-side feature notes on the 8 Lacework alternatives and their CSPM capabilities.
- Product-level coverage of cloud inventory, alerting, and compliance workflows for each option.
- Vendor-specific pros and cons that help teams compare usability, support, and deployment fit.
- A fuller walkthrough of Zluri's SaaS discovery and security features for teams evaluating access control tooling.
👉 Read Zluri's comparison of 8 Lacework alternatives for cloud security →
Cloud security posture tools and the identity governance gap?
Explore further
12/06/2026 6:40 am
Cloud security posture tools are necessary but insufficient because they expose configuration risk without governing identity persistence. The article is really about the gap between visibility and control. That gap matters because cloud access is increasingly carried by non-human identities, and a finding is not the same as a revoked credential. Practitioners should treat posture data as evidence, not enforcement.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A separate finding from that survey shows that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.
A question worth separating out:
Q: Should organisations use CSPM before focusing on NHI lifecycle controls?
A: Yes, if they need immediate cloud visibility. But the mature order of operations is to use posture findings to prioritise NHI lifecycle controls, especially where service accounts, API keys, and integrations create standing access. Discovery is helpful; lifecycle discipline is what reduces persistence and blast radius.
👉 Read our full editorial: Cloud security posture tools miss identity governance gaps in 2026
