Topic starter
23/06/2026 9:10 pm
TL;DR: Service accounts, APIs, and workloads leave entitlement blind spots when cloud identity governance relies on periodic review, according to SecurEnds. Cloud entitlement control has to follow current privilege, or stale approvals will keep hiding effective access.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “IGA and CIEM: How Unified Identity Security Strengthens Cloud Governance”.
Key questions
Q: When should organisations prioritise CIEM over access certification?
A: Prioritise CIEM when cloud permissions change faster than review cycles can capture them, or when workloads and APIs hold more effective privilege than the business records show.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Q: What breaks when legacy IGA is used in cloud-first environments?
A: Legacy IGA breaks down when identity change outpaces manual governance.
Practitioner guidance
- Define separate control ownership for lifecycle and entitlement layers Keep IGA accountable for joiner-mover-leaver processes, access approvals, and certifications, while assigning CIEM to cloud entitlement visibility and least privilege enforcement.
- Inventory non-human identities across cloud platforms Map service accounts, APIs, workloads, OAuth tokens, and cloud roles so the governance model reflects the identities that actually hold privilege.
- Replace annual cloud access reviews with continuous entitlement scanning Use regular scans to catch over-permissioned identities, inherited roles, and default-template drift before those permissions become standing risk.
Bottom line: Multi-cloud identity governance fails when lifecycle control and effective cloud privilege are treated as the same problem.
Glossary terms: Identity Governance and Administration (IGA), Cloud Infrastructure Entitlement Management, Entitlement Drift, Non-Human Identity (NHI)
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 19 hours ago by NHI Mgmt Group
25/06/2026 2:19 am
Cloud entitlement governance is now a two-layer problem: IGA governs lifecycle decisions, but CIEM governs the effective permissions that cloud identities accumulate after provisioning. That split matters because cloud access is shaped by inheritance, defaults, and platform-specific role models that traditional governance cycles do not continuously observe. Practitioners should treat lifecycle approval and cloud privilege analysis as separate control planes.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do when cloud service accounts are more privileged than human users?
A: They should treat those service accounts as privileged identities and bring them into the same governance scope as administrators. That means inventorying them, reviewing their effective permissions, and revoking access paths that exceed task need. Cloud privilege should be governed by impact, not by whether the account is human.
👉 Read our full editorial: IGA and CIEM together: why cloud identity governance is changing