Topic starter
23/06/2026 7:18 pm
TL;DR: Unosecur’s Cloud Compliance Pulse H1 2025 found that 94% of participating organisations had at least one high-severity identity control gap, and 68% of cloud tenants failed privileged-account multifactor authentication. The pattern shows that cloud identity governance now carries audit, insurance, and breach exposure, not just access-review risk.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Unosecur Cloud Compliance Pulse 2025: 40 Identity Failures”.
By the numbers:
- 94% of participating organisations exhibited at least one high-severity gap.
Key questions
Q: What breaks when privileged cloud accounts are not protected by multifactor authentication?
A: The control boundary breaks because privileged access can be reused through stolen passwords, phishing, or replayed sessions.
Q: Why do stale privileged accounts create more risk than their role names suggest?
A: Because the risk is driven by what the account can still do, not by whether anyone remembers assigning it.
Q: What are the signs that non-human identity governance is failing in cloud environments?
A: Common warning signs include credential sprawl, long-lived API keys, unrotated certificates, unclear ownership, and workloads with more access than they need.
Practitioner guidance
- Tighten privileged MFA enforcement Require multifactor authentication for every privileged cloud path, including federation, emergency access, and administrator consoles.
- Reduce standing admin roles Replace permanent high-privilege assignments with just-in-time elevation and document the business owner for each privileged role.
- Track key age as a governance metric Measure the age distribution of access keys monthly and retire keys that exceed policy, especially where service accounts support production workloads.
Bottom line: This benchmark shows that privileged identity failures in cloud estates are still common enough to affect compliance, resilience, and access governance at the same time.
What's in the full report
Unosecur's full news post covers the operational detail this post intentionally leaves for the source:
- The full sampling methodology behind the 50-company benchmark and how the stratified sample was assembled
- The exact control-mapping approach to ISO 27001/27002, PCI DSS v4, SOC 2, CIS v8, and GDPR
- The month-by-month executive metrics Unosecur recommends for audit, insurance, and cloud governance reporting
- The remediation playbook details for privileged MFA, key rotation, and just-in-time elevation
👉 Read Unosecur’s Cloud Compliance Pulse H1 2025 on privileged MFA gaps in cloud estates →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:15 am
Privileged MFA is no longer a point control, it is a programme boundary. When 68% of cloud tenants still fail privileged-account MFA, the issue is not a missing checkbox but a weak trust model. If privileged access can exist without strong authentication in any cloud path, the organisation has already accepted exception-driven governance. The practitioner conclusion is that MFA coverage must be treated as a control boundary for the entire identity programme, not as a local configuration task.
A question worth separating out:
Q: How should organisations manage privileged access for service accounts and secrets?
A: They should treat privileged non-human identities as governed assets with named ownership, defined purpose, rotation, and revocation. The main failure mode is standing privilege with no lifecycle control. PAM should inventory the account or secret, limit its scope, time-box its use, and make revocation automatic when the business need ends.
👉 Read our full editorial: Cloud compliance pulse shows privileged MFA gaps are still widespread