Notifications
Clear all
Topic starter
25/06/2026 12:05 am
TL;DR: Cloud IGA centralises access reviews, certifications, and entitlement visibility across cloud and hybrid environments, reducing manual effort and audit scramble while exposing where legacy IAM stops short, according to SecurEnds. The governance shift matters because access control is now continuous, not periodic, and organisations that cannot keep entitlement decisions current will accumulate risk.
NHIMG editorial — based on content published by SecurEnds: Managing Cloud IGA in the cloud era
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems.
Questions worth separating out
Q: How should teams implement cloud IGA across hybrid environments?
A: Start by normalising identity and entitlement data from HR, IAM, ITSM, cloud directories, and major SaaS platforms.
Q: Why do cloud environments make identity governance harder?
A: Cloud environments increase the number of identities, entitlements, and change events that governance teams must track.
Q: How do teams know whether cloud IGA is actually reducing risk?
A: Look for shorter review cycles, faster revocation, fewer orphaned entitlements, and evidence that approvals lead to real access changes.
Practitioner guidance
- Map entitlement sources before automating reviews Inventory where access data originates across HR, IAM, ITSM, cloud directories, and SaaS platforms.
- Automate review to revocation handoff Do not stop at task completion.
- Separate stable roles from dynamic attributes Use RBAC for durable job functions and ABAC for conditions that change frequently, such as location or environment.
What's in the full article
SecurEnds' full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step cloud IGA deployment guidance for hybrid environments and directory integration.
- Implementation detail on automating access reviews, certifications, and audit evidence collection.
- Practical guidance on pairing RBAC and ABAC across SaaS, cloud infrastructure, and on-prem systems.
- Vendor-specific examples of how SecurEnds structures no-code integrations and analytics workflows.
👉 Read SecurEnds' guide to cloud IGA and continuous access governance →
Cloud IGA and continuous access governance: what changes now?
Explore further
25/06/2026 8:55 am
Cloud IGA is best understood as a governance response to entitlement drift, not a prettier admin console. Once access spans cloud apps, directories, and infrastructure services, the core problem becomes continuity of justification, not the initial grant. That is why Cloud IGA matters to the discipline: it forces governance to follow the entitlement after provisioning, not only at approval time. Practitioners should evaluate whether their current model can still prove who has access, why, and for how long.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
- A separate finding from the same survey shows that 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
A question worth separating out:
Q: Who is accountable when access reviews fail in cloud IGA programmes?
A: Accountability usually sits with the identity owner, the application owner, and the governance operator together, because each controls a different part of the entitlement lifecycle. Frameworks such as the NIST Cybersecurity Framework 2.0 expect governance to be assigned, measured, and acted on, not left implicit.
👉 Read our full editorial: Cloud IGA is shifting identity governance into continuous control
