Topic starter
11/06/2026 10:48 pm
TL;DR: 93% of organisations have overprivileged service accounts, 85% embed plaintext secrets in source code, and 40% allow automatic pull request approvals in GitHub Actions, according to Orca Security’s 2025 cloud security report, showing how identity, secrets, and pipeline control failures compound at scale. Least privilege and secret hygiene are no longer separate problems.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “The Cloud’s Year-End Confessions: What Really Happened in 2025”.
By the numbers:
- 93% of organizations have at least one overprivileged service account.
- 85% of organizations have plaintext secrets embedded in their source code repositories.
Key questions
Q: What breaks when hybrid-cloud service accounts are over-privileged?
A: Over-privileged hybrid-cloud service accounts let attackers reuse trusted access paths instead of escalating from scratch.
Q: Why do exposed secrets keep creating risk after they are detected?
A: Because detection does not stop a credential from remaining valid, and exposed values often persist in repositories, logs, backups, and configuration files.
Q: What are the signs that cloud IAM is failing to protect digital identities?
A: Common warning signs include inconsistent access policies across platforms, weak password practices, limited use of multifactor authentication, and poor visibility into who can reach critical resources.
Practitioner guidance
- Map and shrink identity blast radius Inventory service accounts and IAM roles by actual use, then remove unused privilege and collapse roles that grant broad access to many instances or accounts.
- Automate secret revocation workflows Treat plaintext secrets in repositories as invalid the moment they are detected, and pair scanning with revocation so exposed credentials do not remain usable.
- Review pipeline approval gates Block automatic pull request approvals for infrastructure and application changes that can alter trust boundaries, permissions or public exposure.
Bottom line: The report shows that cloud security failures are increasingly driven by identity scope, secret persistence and permissive automation working together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:09 am
Cloud security now behaves like an identity lifecycle problem: the report’s real message is that permissions, secrets and pipeline approvals are all forms of access that outlive their intended use. When service accounts remain overprivileged and roles stay active for months, cloud risk becomes a governance failure about ownership, review and retirement rather than a single technical defect. The practitioner conclusion is that cloud governance must track who or what still has power after the original need has gone.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams respond when pipeline approvals can be bypassed automatically?
A: They should treat approval bypass as an identity control problem, not just a developer workflow issue. If unreviewed changes can reach production, the pipeline can become a privilege escalation path for malicious code, dangerous infrastructure changes or secret exposure. The right response is to restore human or policy gates before trust boundaries are crossed.
👉 Read our full editorial: Cloud security in 2025: forgotten permissions and exposed secrets
This post was modified 1 day ago by NHI Mgmt Group