Notifications
Clear all
Topic starter
06/06/2026 2:11 am
TL;DR: C1’s collaboration with Wiz connects cloud risk findings to governance actions, so misconfigurations, exposed credentials, overprivileged identities, and attack paths can trigger access reviews, policy enforcement, or entitlement revocation without manual handoffs, according to ConductorOne. The governance problem is no longer visibility alone, but whether access decisions can keep pace with risk as cloud posture changes.
NHIMG editorial — what this means for AI and NHI governance
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.
Questions worth separating out
Q: How should security teams use cloud risk findings in access governance?
A: Security teams should map cloud risk findings to explicit governance outcomes such as access review, step-up approval, reduced privilege, or revocation.
Q: Why do cloud posture changes create problems for least privilege?
A: Cloud posture changes can invalidate least-privilege decisions after access has already been granted.
Q: What breaks when risk findings stay separate from identity workflows?
A: When findings stay separate from identity workflows, organisations keep the visibility but lose the enforcement.
Practitioner guidance
- Map cloud findings to governance outcomes Define which Wiz findings should trigger stricter approval, access review, or entitlement revocation, and make the mapping explicit in policy.
- Embed cloud context into review workflows Show finding category, severity, and affected resource directly inside access approval and recertification screens so approvers see the risk in the same step as the decision.
- Treat posture changes as entitlement events Create operational triggers so new exposures or attack paths can downgrade or revoke access immediately, rather than waiting for the next scheduled review.
What's in the full announcement
ConductorOne's full post covers the operational detail this post intentionally leaves for the source:
- How the Wiz findings are mapped into specific policy actions inside the governance engine
- Workflow examples showing when a finding should trigger stricter approval versus revocation
- The inline approval context that surfaces severity, category, and affected resources for reviewers
- The integration flow details that eliminate manual exports, handoffs, and custom pipelines
👉 Read ConductorOne's announcement on cloud risk findings feeding access decisions →
Cloud risk findings and autonomous access decisions: what changes now?
Explore further
06/06/2026 3:43 am
Risk-aware governance is becoming the missing control plane for cloud identity. Security telemetry that stays in a dashboard does not change entitlements, approvals, or review outcomes. The field is moving toward a model where cloud posture directly informs governance actions, because visibility without decision enforcement leaves privilege untouched. Practitioners should treat risk-to-governance integration as an architectural requirement, not an optimisation.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when a risk finding should have changed access but did not?
A: Accountability usually sits across both the security team that generated the finding and the identity team that owns the decision workflow. If the finding did not trigger a policy response, the gap is usually in governance design, not detection quality. Teams should assign ownership for the decision path itself, not just the alert source.
👉 Read our full editorial: Cloud risk findings to real-time access decisions for NHI governance
