Notifications
Clear all
Topic starter
12/06/2026 12:47 am
TL;DR: Cloud access governance defines how organisations control who can access, use, and change cloud resources, and the article argues that weak revocation, auditing, and real-time monitoring create avoidable security, compliance, and onboarding failures, according to Zluri. The real issue is not cloud scale alone, but whether identity governance can keep pace with distributed access rights and offboarding.
NHIMG editorial — based on content published by Zluri: IT Teams Cloud Access Governance, an in-depth guide to cloud access governance
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should security teams govern cloud access across both human users and non-human identities?
A: They should use one lifecycle model for all cloud entitlements, then apply different controls by actor type.
Q: Why does cloud access governance still fail even when SSO and MFA are in place?
A: Because authentication only answers who logged in, not what that identity is allowed to reach after login.
Q: What breaks when cloud access reviews are done only on a fixed schedule?
A: Stale access accumulates between review cycles, especially in fast-moving cloud environments where roles and resources change continuously.
Practitioner guidance
- Tie access review to lifecycle events Trigger review and removal actions when employees change roles, leave teams, or exit the organisation.
- Use JIT for privileged cloud tasks Reserve elevated access for administrative or troubleshooting work, then expire it automatically when the task ends.
- Monitor post-authentication access patterns Track unusual resource use, abnormal login timing, and access paths that do not match assigned job roles.
What's in the full article
Zluri's full guide covers the operational detail this post intentionally leaves for the source:
- Role-by-role access governance workflows for cloud environments, including approval routing and entitlement assignment.
- Step-by-step guidance for implementing JIT access, access audits, and real-time monitoring across cloud applications.
- Examples of automated provisioning and deprovisioning logic for onboarding and offboarding workflows.
- Usage and risk analytics patterns that help identify abnormal access before it becomes a security incident.
👉 Read Zluri's guide to cloud access governance and JIT controls →
Cloud access governance: what IAM teams are missing now?
Explore further
12/06/2026 10:15 am
Cloud access governance is really a lifecycle problem, not a dashboard problem. The article correctly centers access policies, reviews, monitoring, and deprovisioning because cloud risk emerges when permissions outlive the business need that created them. That is the same failure mode seen across NHI governance, where revocation lag and access drift create durable exposure. Practitioners should treat cloud governance as an entitlement lifecycle discipline, not a reporting exercise.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, showing that governance breaks often begin long before an access review reaches the queue.
A question worth separating out:
Q: Who is accountable when cloud access is not revoked after someone leaves?
A: Accountability should sit with the identity, cloud, and system owners together, because offboarding failure is usually a cross-functional control gap. Human HR events, IAM workflows, and cloud application permissions all have to complete together. Frameworks such as the NIST Cybersecurity Framework 2.0 and NIST CSF access controls are relevant to that accountability model.
👉 Read our full editorial: Cloud access governance is now a core IAM control gap
