Notifications
Clear all
Topic starter
25/06/2026 12:27 am
TL;DR: Cloud infrastructure entitlement management addresses the hidden problem of excessive and unused permissions across AWS, Azure, and GCP, where IAM alone does not provide enough visibility or control over human and machine access, according to SecurEnds. The real issue is not cloud growth itself, but the widening gap between granted access and what identity governance can actually prove.
NHIMG editorial — based on content published by SecurEnds: Cloud Infrastructure Entitlement Management (CIEM) guide
Questions worth separating out
Q: How should security teams implement CIEM in multi-cloud environments?
A: Start by inventorying every user, workload, service account, and API key across AWS, Azure, and GCP, then map effective privilege rather than relying on assigned roles alone.
Q: Why does CIEM matter more as cloud estates grow?
A: Cloud growth multiplies permissions faster than manual review cycles can keep up.
Q: What breaks when least privilege is managed only in IAM?
A: IAM can grant access, but it does not continuously prove whether the access is still needed or safe in context.
Practitioner guidance
- Map effective privilege across all cloud identities Inventory users, service accounts, workloads, and API keys, then map what each identity can actually do across AWS, Azure, and GCP.
- Prioritise unused and high-risk permissions for cleanup Target dormant roles, standing admin rights, and permissions that are granted but rarely used.
- Connect CIEM output to access review and PAM workflows Feed entitlement findings into access certification, privileged access review, and exception handling so changes do not stop at reporting.
What's in the full article
SecurEnds' full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step CIEM workflow examples for discovering entitlements across AWS, Azure, and GCP.
- Side-by-side comparisons of CIEM tools and the kinds of cloud environments they fit best.
- Implementation guidance for connecting entitlement findings to IAM, CSPM, and CNAPP workflows.
- Audit and compliance checklist details for teams preparing evidence packs and access reviews.
👉 Read SecurEnds' full guide to cloud infrastructure entitlement management →
Cloud entitlement sprawl in multi-cloud environments: are controls keeping up?
Explore further
25/06/2026 9:22 am
Cloud entitlement sprawl is a governance failure, not a visibility problem. The issue is not merely that organizations cannot see permissions, but that they have allowed cloud access to become distributed across users, workloads, and machine identities without a stable ownership model. CIEM matters because effective privilege is now the real control surface in multi-cloud estates. Practitioners should treat entitlement sprawl as a governance defect that survives even when perimeter and configuration controls look healthy.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organisations know if CIEM is actually working?
A: Look for fewer unused permissions, faster removal of excessive roles, and a shrinking set of identities with broad cross-cloud reach. If access reviews become evidence-based and remediation is automatic for low-risk changes, the programme is moving from reporting to control.
👉 Read our full editorial: Cloud infrastructure entitlement management and the real cloud access gap
