Topic starter
25/06/2026 1:09 am
TL;DR: Cloud security access management is under strain as multi-cloud, manual credential handling, and incomplete lifecycle controls leave organisations exposed, according to Bravura Security’s analysis of 100 security leaders and cited breach data. The core issue is not tooling volume but whether identity governance can keep pace with changing access, rogue accounts, and recovery demands.
Editorial analysis by NHI Mgmt Group, based on content published by Bravura Security: “The Biggest Problems in Cloud Security Access Management”.
By the numbers:
- In 2022, Bravura Security surveyed 100 security leaders on cloud security access management.
- 49% of teams used spreadsheets to store cloud passwords.
- 75% managed application credentials this way.
Key questions
Q: What breaks when cloud access management still relies on spreadsheets and manual cleanup?
A: The control breaks at ownership, rotation, and recovery.
Q: Why do weak cloud remote access controls increase breach risk?
A: Weak remote access controls increase breach risk because they expose the entry paths that connect users, devices, and cloud resources.
Q: How do you know if joiner-mover-leaver controls are actually working in cloud environments?
A: They are working only if identity changes propagate quickly into every cloud admin plane and stale access disappears without manual chasing.
Practitioner guidance
- Audit spreadsheet-held credentials Find every place cloud passwords or application credentials are stored outside governed systems, then assign owners and removal deadlines for each location.
- Map lifecycle closure points Document where joiner, mover, and leaver events do not reach cloud admin planes, especially for contractors, temporary workers, and delegated admins.
- Measure recovery time for compromised passwords Test how long it takes to replace a compromised cloud credential from detection through full revocation, including emergency access paths and fallback authentication.
Bottom line: Cloud access management fails most often when credential handling and lifecycle control lag behind the pace of change in multi-cloud estates.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:22 am
Cloud access management has become a lifecycle problem, not a login problem. The article shows that many organisations can still enforce policy but cannot complete the downstream work of revocation, recovery, and exception handling at the same speed. That means the control failure sits in identity operations, not in authentication alone. Practitioners should treat cloud access as a governed lifecycle with measurable handoff points, not as a static access rule set.
A few things that frame the scale:
- Valid account abuse was responsible for 35% of cloud-related incidents, according to CrowdStrike's 2025 Global Threat Report.
A question worth separating out:
Q: What should security teams do when passwordless and SSO still leave fallback access paths?
A: Treat fallback access as a governed control path, not an exception. Review who can use it, when it is triggered, and how quickly it is revoked after use. If the fallback path is weaker than the primary one, attackers will target it.
👉 Read our full editorial: Cloud security access management gaps are widening in multi-cloud