Topic starter
23/06/2026 9:10 pm
TL;DR: As enterprises move into multi-cloud, IGA alone no longer covers the full identity surface because service accounts, APIs, and workloads create entitlement blind spots, according to SecurEnds. Pairing governance with CIEM shifts security from periodic review to continuous cloud entitlement control, which is now the practical baseline for IAM and NHI programmes.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “IGA and CIEM: How Unified Identity Security Strengthens Cloud Governance”.
Key questions
Q: What breaks when legacy IGA is used in cloud-first environments?
A: Legacy IGA breaks down when identity change outpaces manual governance.
Q: When should organisations prioritise CIEM over access certification?
A: Prioritise CIEM when cloud permissions change faster than review cycles can capture them, or when workloads and APIs hold more effective privilege than the business records show.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Define separate control ownership for lifecycle and entitlement layers Keep IGA accountable for joiner-mover-leaver processes, access approvals, and certifications, while assigning CIEM to cloud entitlement visibility and least privilege enforcement.
- Inventory non-human identities across cloud platforms Map service accounts, APIs, workloads, OAuth tokens, and cloud roles so the governance model reflects the identities that actually hold privilege.
- Replace annual cloud access reviews with continuous entitlement scanning Use regular scans to catch over-permissioned identities, inherited roles, and default-template drift before those permissions become standing risk.
Bottom line: Multi-cloud identity governance fails when lifecycle control and effective cloud privilege are treated as the same problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:19 am
Cloud entitlement governance is now a two-layer problem: IGA governs lifecycle decisions, but CIEM governs the effective permissions that cloud identities accumulate after provisioning. That split matters because cloud access is shaped by inheritance, defaults, and platform-specific role models that traditional governance cycles do not continuously observe. Practitioners should treat lifecycle approval and cloud privilege analysis as separate control planes.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do when cloud service accounts are more privileged than human users?
A: They should treat those service accounts as privileged identities and bring them into the same governance scope as administrators. That means inventorying them, reviewing their effective permissions, and revoking access paths that exceed task need. Cloud privilege should be governed by impact, not by whether the account is human.
👉 Read our full editorial: IGA and CIEM together: why cloud identity governance is changing