Topic starter
17/08/2026 4:38 pm
TL;DR: Clarity Security argues that identity has become the cloud perimeter, but many organisations still govern access with fragmented reviews, siloed visibility, and manual decisions that leave excessive entitlement, stale accounts, and unclear ownership in place. The control gap is after entry, where access governance functions like a firewall with open ports and an underestimated blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “Reflections on Identiverse 2025: Identity Is the New Perimeter. So Why Are the Ports Still Wide Open?”.
Key questions
Q: How should teams close the governance gap after authentication in cloud environments?
A: Treat post-authentication governance as the control that limits blast radius, not as a cleanup exercise.
Q: Why do stale accounts and unused groups increase cloud risk?
A: Stale accounts and unused groups widen the blast radius because they preserve reachable access paths that no longer match current job duties or system needs.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Practitioner guidance
- Map standing access to named owners Build an entitlement inventory that identifies the business owner, technical owner, and review cadence for every persistent permission, including stale accounts and group memberships.
- Prioritise excessive entitlement removal Focus first on permissions that grant admin, cross-environment, or broad data access because those items expand blast radius fastest when they remain active.
- Replace manual review queues with context-driven decisions Use current usage, role alignment, and last-access evidence to decide whether access should stay, shrink, or be revoked instead of relying on static certification checklists.
Bottom line: Identity governance determines whether cloud access stays aligned to business need after authentication, which makes it a frontline security control rather than an administrative afterthought.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- The article's plain-language mapping of “open ports” to specific entitlement conditions that create risk in cloud programmes.
- The governance questions it suggests for access owners when deciding whether access should stay, shrink, or be revoked.
- The discussion of why SSO, MFA, and conditional access are table stakes but do not solve post-login governance.
- The framing of a unified identity, access, and context model for teams trying to reduce blast radius.
👉 Read Clarity Security's analysis of identity governance as the cloud firewall gap →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:44 pm
Identity governance is the real firewall in cloud environments. Authentication controls secure the front door, but they do not reduce what a user can reach after entry. Once entitlement sprawl, stale accounts, and unmanaged group membership accumulate, the effective security boundary moves to governance. Practitioners should treat access certification and ownership as perimeter controls, not back-office hygiene.
A question worth separating out:
Q: Should organisations prioritise access review coverage or access review quality?
A: Quality should come first when access reviews are manual or context-poor. A partial review process can create more confidence than control, especially if it misses privileged roles, dormant accounts, or service identities. Teams should review the most risk-heavy access paths with enough context to make removal decisions, not just tick completion boxes.
👉 Read our full editorial: Identity governance is the firewall cloud programs keep leaving open