Topic starter
03/06/2026 11:52 am
TL;DR: 92% of cloud permissions in enterprise estates went unused for more than 90 days, and 87% of that inactive access belonged to machine identities, according to Sonrai Security research. The result is a much larger blast radius, with legacy PAM and visibility tools unable to contain permissions that remain standing but inactive.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Why 92% of Cloud Permissions Are Never Used, and What That Costs You”.
By the numbers:
- 92% of all identities with access to sensitive permissions did not use them over 90 days.
- 87% of the unused-access group were machine identities.
Key questions
Q: What breaks when cloud identities are over-permissioned?
A: Over-permissioned identities create a wider blast radius than the business intended.
Q: Why do dormant cloud permissions create audit and compliance problems?
A: Because auditors need a defensible justification for sensitive access, and unused permissions are hard to explain when the original business need no longer exists.
Q: How can security teams tell whether permission cleanup is working?
A: Look for a shrinking gap between assigned entitlements and actual runtime use.
Practitioner guidance
- Audit unused sensitive permissions by runtime evidence Compare assigned entitlements with 90-day usage data for cloud roles, service accounts, and integrations.
- Quarantine dormant identities before deleting them Strip access from identities that appear inactive, but preserve the identity object so occasional workloads can request access through an approval workflow when needed.
- Move JIT enforcement to the permission layer Ensure sensitive permissions are absent in steady state and granted only for a task window to the exact human, machine, or agent that needs them.
Bottom line: Unused cloud permissions expand compromise impact even when they appear inactive, because the permissions remain usable the moment a credential is taken over.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 11:54 am
Unused cloud permission is a blast-radius problem, not a permissions-count problem. The central risk is not how many identities exist, but how much reachable action remains attached to identities that no longer need it. When 92% of sensitive permissions sit unused, the enterprise is carrying a hidden expansion of the compromise domain. The practitioner conclusion is that blast radius must be governed as a first-class identity metric.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations remove unused cloud access or quarantine it first?
A: Quarantine is usually safer than deletion when the original purpose of an identity is not fully documented. It preserves the identity object, strips access, and allows rare legitimate use to be restored through approval if needed. That approach reduces blast radius without forcing teams to guess which dormant workloads are truly dead.
👉 Read our full editorial: Unused cloud permissions are widening enterprise blast radius