Topic starter
20/04/2026 8:08 pm
TL;DR: Cloud infrastructure, CI/CD automation, and agentic AI now create identities and permissions faster than manual governance can review them, leaving static IAM, quarterly reviews, and standing access exposed to drift and over-privilege, according to Token Security. The control problem is no longer visibility alone, but matching identity governance to machine-speed change.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Why Access Risk Is Moving Faster Than Cloud Security Controls”.
By the numbers:
- Non-Human Identities now outnumber human employees by at least 45 to 1, according to Token Security.
Key questions
Q: What breaks when access reviews are only annual in cloud IAM?
A: Annual reviews miss the pace of cloud change.
Q: Why do service accounts and tokens create more risk than many teams expect?
A: Because they often carry standing privilege, operate quietly, and remain valid long after the business need changes.
Q: How do security teams know whether cloud access policy is actually working?
A: They should test whether policy decisions are traceable from discovery to approval to revocation.
Practitioner guidance
- Implement event-driven identity inventory Capture every new service account, token, and workload identity as it is created in cloud and SaaS environments.
- Replace quarterly reviews for fast-changing access Limit human access reviews to durable entitlements and move machine identity governance to continuous verification.
- Enforce just-in-time access for privileged cloud actions Remove standing privilege for sensitive operations and require short-lived issuance tied to a specific task or request.
Bottom line: Cloud access risk has outgrown manual IAM because identities and permissions now change at machine speed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 4:27 pm
Velocity, not visibility, is now the primary control problem: cloud governance fails when access changes faster than review cycles can observe it. The issue is not that organisations cannot see identities at all, but that they see them too late to influence the risk state. This shifts identity security from periodic assurance to continuous control of issuance, privilege, and duration. Practitioners should treat time-to-governance as a control metric, not an operational inconvenience.
A few things that frame the scale:
- 82% of breaches involved data stored in the cloud, according to IBM (2024).
A question worth separating out:
Q: What happens when an AI agent is allowed to act in the cloud without clear containment controls?
A: A misbehaving or compromised agent can access unauthorized systems, expose sensitive data, or trigger downstream actions faster than human responders can intervene. If the environment lacks predefined containment workflows, the team may see the problem only after it has spread. Logging every action and setting thresholds for human review help limit that blast radius.
👉 Read our full editorial: Why access risk is outpacing cloud security controls