Topic starter
16/01/2026 5:09 pm
TL;DR: Zero Trust for cloud security replaces perimeter trust with continuous verification, least privilege, and monitoring across users, devices, workloads, and actions, according to StrongDM’s analysis. For NHI governance, the real test is whether those controls extend to service accounts, tokens, and automation paths rather than stopping at human access.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “What Is Zero Trust for the Cloud? (And Why It's Important)”.
Key questions
Q: What breaks when service accounts are not included in zero-trust verification?
A: The control only covers people while the attacker uses machine access.
Q: Why do service account secrets create so much risk in zero trust architecture?
A: Service account secrets create risk because they often provide standing, non-interactive access to multiple systems.
Q: How can security teams tell whether zero trust is actually working in AWS?
A: Look for evidence that access is issued for a narrow purpose, expires automatically, and is auditable across accounts and resource types.
Practitioner guidance
- Map cloud zero trust coverage to NHI control points Inventory service accounts, tokens, API keys, certificates, and automation identities, then confirm which ones are governed by the same authorization and monitoring policies as human users.
- Reduce standing privilege in cloud automation Identify workloads and scripts that keep broad access after deployment or maintenance tasks end, and re-scope them to task-specific permissions.
- Make workload telemetry identity-aware Correlate cloud logs so machine actions can be traced to the underlying non-human identity, not just the source IP or application name.
Bottom line: Zero trust for cloud security fails when machine identities are excluded from the same authorization model used for people.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 9:37 pm
Zero trust in the cloud is really NHI governance because cloud control surfaces are dominated by machine identities. Human sign-in controls matter, but cloud operations run on service accounts, tokens, automation, and workload identities. If those identities are not inventoried, authorized, and reviewed, the programme only looks like zero trust at the perimeter.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between access review and true NHI governance?
A: Access review checks whether an identity still exists and whether its permissions look acceptable at a point in time. True NHI governance also tracks ownership, behavior, lifecycle, dependency chains, and revocation readiness. In other words, governance asks whether the identity still belongs in the environment and whether it can be safely used right now.
👉 Read our full editorial: Zero trust for the cloud is really NHI governance in disguise