Topic starter
06/01/2026 4:35 pm
TL;DR: Cloud privilege is governed by granular permissions across humans, machines, pipelines, AI agents, and third parties, and Sonrai Security argues legacy PAM cannot scale to that model; the article cites more than 18,000 AWS permissions, with 1,095 considered privileged. The core issue is not login control but continuous permission-level governance across rapidly changing cloud identities.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Cloud Privilege Is a Mess. Why Legacy PAM Can’t Fix It.”.
By the numbers:
- 92% of identities holding these privileged permissions never use them.
Key questions
A: Traditional PAM breaks down when it cannot keep up with cloud speed.
A: Overprivileged identities widen the range of actions an attacker or misconfigured workflow can take.
Q: What are the signs that cloud privilege sprawl is getting out of control?
A: The clearest signs are broad permission sets, many identities with access they rarely or never exercise, and privilege spread across multiple identity types that no single team reviews end to end.
Practitioner guidance
- Map privilege at the permission level Inventory high-risk cloud permissions across AWS, Azure, and GCP, then identify where those permissions exist outside genuine business need.
- Treat non-human identities as primary privilege holders Include workloads, pipelines, third-party integrations, and AI agents in the same privilege review model used for human administrators.
- Deny new privilege by default Use policy enforcement to prevent newly created identities from inheriting privileged permissions unless an explicit exception exists.
Bottom line: Cloud privilege in public cloud is governed by permissions, not by the existence of an admin account or session-based login.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:07 pm
Cloud privilege sprawl is an entitlement governance problem before it is a privileged access problem. The article correctly shifts attention away from the old assumption that privilege is centered on admin accounts. In cloud environments, privilege is distributed across permissions, identities, and automated actors, so the real control boundary is entitlement scope. That makes continuous permission governance the decisive discipline for cloud IAM and PAM teams.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern privileged access across humans, workloads, and agents?
A: Teams should govern privileged access through one access lifecycle, not separate controls for each identity type. That means aligning discovery, approval, session control, and revocation so humans, workloads, and agents all follow the same authority model. If privilege cannot be traced end to end, teams do not have governance, only partial visibility.
👉 Read our full editorial: Legacy PAM cannot control cloud privilege sprawl in dynamic environments