Topic starter
11/06/2026 11:15 pm
TL;DR: 55% of organisations use two or more cloud providers, 84% use AI in the cloud, and 62% have at least one vulnerable AI package, while nearly a third of cloud assets remain neglected or unpatched, according to Orca Security’s 2025 State of Cloud Security Report. The real constraint is not visibility alone but identity, privilege, and lifecycle control across expanding cloud estates.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “What is Cloud Security?”.
By the numbers:
- 55% of organisations use two or more cloud providers.
- 84% use AI in the cloud.
- 62% have at least one vulnerable AI package.
Key questions
Q: How should security teams govern identity and configuration risk across multi-cloud environments?
A: Security teams should treat multi-cloud governance as a single operating problem, not a collection of isolated cloud projects.
Q: Why do standing cloud permissions increase attack paths?
A: Standing permissions increase attack paths because they remain usable long after the original business need has passed.
Q: What are the signs that non-human identity governance is failing in cloud environments?
A: Common warning signs include credential sprawl, long-lived API keys, unrotated certificates, unclear ownership, and workloads with more access than they need.
Practitioner guidance
- Map cloud entitlements across every provider Create a single inventory of cloud roles, service accounts, tokens, and workload permissions across all active cloud platforms.
- Convert standing access to just-in-time access Reserve persistent permissions for only the smallest set of break-glass use cases.
- Bind AI workloads to least-privilege credentials Treat AI packages and model-integrated services as access-bearing identities.
Bottom line: Cloud security exposure in this article is driven less by raw cloud adoption than by the difficulty of governing identity, privilege, and lifecycle across multiple providers and AI workloads.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
12/06/2026 7:51 am
Cloud security has become an identity governance problem before it is a tooling problem. The article’s own evidence shows that cloud estates are now defined by multi-provider complexity, AI adoption, and long-lived access paths. That combination pushes governance decisions into IAM, PAM, and NHI lifecycle control rather than leaving them in posture-only tooling. Practitioners should treat cloud security as the operational management of who or what can act, not just what is exposed.
A few things that frame the scale:
- Valid account abuse was responsible for 35% of cloud-related incidents, according to CrowdStrike's 2025 Global Threat Report.
A question worth separating out:
Q: Should teams prioritise AI security posture or cloud identity controls first?
A: They should treat them as the same control problem when AI workloads run in cloud environments. Securing the package without constraining its identity leaves access risk in place, while tightening identity without understanding the model and dependency chain leaves operational blind spots. The right sequence is to govern both together.
👉 Read our full editorial: Cloud security is exposing identity gaps across multi-cloud estates
This post was modified 2 days ago by NHI Mgmt Group