Topic starter
23/06/2026 7:16 pm
TL;DR: Unosecur’s Cloud Compliance Pulse H1 2025 found that 94% of organisations had at least one high-severity cloud identity gap, with an average of 40 identity and access control failures per tenant and 68% failing privileged MFA. Cloud identity governance is still breaking at the control layer, where basic privileges, credentials and vault discipline are not consistently enforced.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Unosecur Cloud Compliance Pulse 2025: 40 Identity Failures”.
Key questions
Q: What should teams fix first when cloud identity compliance gaps are still widespread?
A: Start with the controls that most directly reduce standing risk: privileged MFA, high-privilege role scope, service-account key hygiene and vaulting.
Q: Why do privileged cloud identities create such persistent audit and breach risk?
A: Because they concentrate access and often outlive the task that justified them.
Q: What breaks when service-account keys are not treated as lifecycle-managed credentials?
A: They accumulate in scripts, automation and cloud workflows after the original use case has changed, so revocation and rotation are delayed or missed.
Practitioner guidance
- Enforce privileged MFA at the identity provider Remove local exceptions for cloud-admin access and validate that every privileged path depends on centrally enforced multifactor authentication.
- Replace standing admin roles with task-scoped elevation Review permanent high-privilege assignments and convert routine administration to just-in-time access with explicit expiry and approval boundaries.
- Rotate and vault service-account keys on a fixed lifecycle Track service-account secrets separately from human credentials, rotate keys older than thirty days, and store them in a managed vault with owner assignment.
Bottom line: Cloud identity compliance gaps persist because basic enforcement is still uneven across privileged users, roles and service-account credentials.
What's in the full report
Unosecur's full report covers the operational detail this post intentionally leaves for the source:
- The full breakdown of the 50-company sample methodology and control mapping across ISO 27001, PCI DSS v4, SOC 2, CIS v8 and GDPR
- The exact distribution of the four recurring gap families across enterprise cloud estates
- The monthly measurement model for privileged MFA coverage, permanent high-privilege roles, key age and service-account secrets
- The remediation guidance for replacing standing admin roles with just-in-time elevation and rotating older keys
👉 Read Unosecur's Cloud Compliance Pulse H1 2025 on cloud identity compliance gaps →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:12 am
Cloud identity compliance is still failing at the control layer, not the policy layer: The problem is no longer whether organisations know the rules. It is whether privileged MFA, role scoping and key governance are enforced consistently across tenants, identities and workflows. That is why the same four gap families keep reappearing in cloud audits and breach reviews. Practitioners should treat tenant-level enforcement as the real governance test.
A question worth separating out:
Q: How should IAM and PAM teams judge whether cloud identity controls are actually working?
A: Look at the proportion of privileged identities protected by MFA, the number of standing high-privilege assignments, the age profile of access keys, and the amount of secret material stored outside a managed vault. If those measures do not improve month by month, the programme is not reducing risk.
👉 Read our full editorial: Cloud identity compliance gaps persist across most enterprise tenants