Topic starter
16/04/2026 6:36 pm
TL;DR: Privileged access abuse still sits behind most cloud breaches, with Sonrai Security arguing that over-permissioned service accounts, inherited IAM roles, and standing privileges create the conditions attackers need. Cloud PAM only works when teams discover every identity, right-size access from actual usage, and eliminate dormant privilege before it becomes a breach path.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Top Cloud Privileged Access Management Best Practices to Prevent Privilege Abuse”.
By the numbers:
- 92% of identities are over-permissioned, and 62% are dormant.
Key questions
Q: What breaks when cloud privileged accounts are not continuously discovered and managed?
A: When discovery is incomplete, organisations lose visibility into unknown admins, stale delegated access, and privilege changes that happen faster than manual review cycles.
Q: Why do standing privileges increase breach impact in cloud and enterprise environments?
A: Standing privileges enlarge the attacker’s options because one exposed administrative path can be reused for lateral movement, persistence, or broad operational control.
Q: When should organisations prioritise workload IAM over extending PAM?
A: Organisations should prioritise workload IAM when privileged access is driven by CI/CD, cloud workloads or AI agents that need fast, repeatable access without human interaction.
Practitioner guidance
- Inventory every privileged cloud identity Build a complete inventory of human users, service accounts, machine roles, APIs and delegated cloud identities that can perform high-impact actions.
- Right-size access from observed usage Review what each identity has actually exercised and remove permissions that have not been used.
- Eliminate standing privilege for high-risk actions Move sensitive cloud permissions to just-in-time workflows so elevated access exists only for the duration of a task and is revoked automatically when it ends.
Bottom line: Cloud breaches still frequently hinge on privileged access abuse, especially where access persists after the original business need has passed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 2:37 am
Cloud privilege has outgrown the traditional admin model: Cloud PAM now has to govern every identity that can perform high-impact actions, not just human administrators. That includes service accounts, pipelines, workload roles and delegated app identities. The field has moved from account management to permission economics, where the question is how much damage any one identity can cause if it is compromised. Practitioners should model privilege by capability, not by job title.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What role do M&A events play in cloud privilege risk?
A: Acquisitions often import inherited roles, stale credentials and access standards that no longer match the acquiring organisation. That creates a governance gap where access remains active but no one can justify it cleanly. Teams should treat post-merger cleanup as a privileged access exercise, because leftover cloud access is one of the easiest ways for risk to persist.
👉 Read our full editorial: Cloud privileged access management best practices for cloud breaches