Notifications
Clear all
Topic starter
02/08/2026 12:06 pm
TL;DR: Cloud security tools often miss risky IAM usage patterns such as long-term credentials in GitHub pipelines, delegated root access, and cross-account permission-set drift, according to Exaforce. The underlying problem is not visibility alone but weak identity governance around standing credentials, trust boundaries, and continuous monitoring.
NHIMG editorial — based on content published by Exaforce: Bridging the Cloud Security Gap: Real-World Use Cases for Threat Monitoring
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should security teams handle long-term IAM credentials in cloud pipelines?
A: Treat long-term pipeline credentials as standing privilege with a broad blast radius.
Q: Why do static credentials create more risk than ephemeral access for cloud admins?
A: Static credentials create standing privilege, which means one leak can remain usable until someone finds and revokes it.
Q: What breaks when root access is delegated to a third party?
A: What breaks is direct accountability for the most powerful account in the environment.
Practitioner guidance
- Inventory standing cloud credentials Catalogue IAM users, access keys, pipeline secrets, and third-party root paths that remain valid beyond a single task.
- Correlate cloud activity with expected identity behaviour Use CloudTrail and SIEM detections to compare each identity’s normal resource, location, and user-agent patterns against actual usage.
- Replace static pipeline secrets with short-lived credentials Move CI/CD deployments off long-term AWS keys and use federated, temporary credentials for build and release paths.
What's in the full article
Exaforce's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step monitoring patterns for IAM users that move across multiple locations and operating contexts
- Detection logic for CloudTrail and SIEM correlation when access patterns, regions, or user agents drift
- Remediation guidance for replacing GitHub pipeline secrets with temporary OIDC-based access
- Practical handling of root access delegation and centralized privileged execution paths
👉 Read Exaforce's blog on cloud security gap use cases and IAM monitoring →
Long-term IAM credentials in cloud workflows: what teams should fix now?
Explore further
02/08/2026 1:11 pm
Standing cloud credentials are the real governance liability, not just a monitoring gap. The article’s examples show that long-term IAM users, embedded secrets, and delegated root access all create identities that outlive the work they were meant to perform. Continuous monitoring helps, but it cannot fully compensate for access that was never designed to expire. The practitioner conclusion is that cloud identity posture must be built around lifecycle ownership, not observation alone.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- A separate finding shows that only 13% of organisations feel extremely prepared for agentic AI, which explains why static access patterns keep surviving policy discussions.
A question worth separating out:
Q: Who is accountable when cross-account trust policies drift?
A: The account owner remains accountable, even when the drift happens in shared cloud governance constructs. Teams need explicit ownership for role assumptions, permission sets, and management-account changes so that privilege changes cannot hide in the control plane. Continuous review should sit with the platform and security functions together.
👉 Read our full editorial: Cloud IAM monitoring gaps exposed by long-term credential patterns
