How should security teams reduce identity sprawl across hybrid and multi-cloud environments?

Why Identity Sprawl Becomes a Security Problem

Identity sprawl is not just an inventory issue. In hybrid and multi-cloud environments, every workload, pipeline, partner connection, and cloud service principal can become a separate trust decision with its own secrets, permissions, and lifecycle. That creates gaps where governance, revocation, and monitoring stop flowing across systems. NIST’s Cybersecurity Framework 2.0 treats identity as a core control point, but many enterprises still manage it in fragments.

NHI Management Group research shows the scale of the issue: 35.6% of organisations say consistent access across hybrid and multi-cloud environments is their top NHI security challenge, and only 5.7% have full visibility into their service accounts. That combination means teams often discover duplicated principals, stale secrets, and over-permissioned accounts only after an incident or migration has exposed them. The practical risk is not the count of identities, but the unmanaged overlap between them.

Security teams usually think they have an identity program until one cloud account, one CI/CD token, or one partner integration is exempt from the controls everyone else follows.

How to Reduce Sprawl Without Breaking Operations

The most effective approach is to reduce sprawl by standardising identity ownership, reducing long-lived credentials, and making access decisions visible across environments. Start with a complete inventory of human users, machine identities, workload identities, partner principals, and cloud-native service accounts. Then map each identity to a system of record, a business owner, and a revocation path. Without that mapping, cleanup work tends to remove the easy accounts while leaving the high-risk ones untouched.

For machine and agentic workloads, current guidance suggests shifting away from static role assignments wherever possible. Autonomous or event-driven systems do not behave like human users, so fixed RBAC alone often produces excess privilege. Instead, use workload identity and runtime authorisation so access is granted only when the workload proves what it is and what it is trying to do. Standards such as SPIFFE help establish cryptographic workload identity, while policy engines such as Open Policy Agent support request-time evaluation.

• Replace shared secrets with per-workload, short-lived credentials wherever the platform supports it.
• Centralise discovery across cloud accounts, CI/CD, secret managers, and SaaS integrations.
• Tag each identity with owner, environment, business function, and expiry so cleanup can be automated.
• Block new identities by default unless they are created through a controlled onboarding path.

NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is why cleanup must include entitlement review, not just account deletion. Pair that with incident learnings from the 52 NHI Breaches Analysis, where repeated patterns show that exposed credentials and weak lifecycle control are rarely isolated failures.

These controls tend to break down when teams operate separate IAM stacks for each cloud and have no common ownership model for service accounts, CI/CD secrets, and SaaS API keys.

Where Cleanup Efforts Usually Fail

Tighter identity control often increases operational overhead, so organisations have to balance consolidation against delivery speed and legacy dependencies. The hardest cases are not new workloads, but old integrations that still rely on embedded secrets, shared service accounts, or cloud-specific exceptions. Best practice is evolving here: there is no universal standard for a single identity plane across every cloud, so many teams adopt a federated model with common policy and local enforcement.

One common failure mode is assuming that decommissioning an application automatically removes its identities. In practice, tokens survive in code, pipelines, caches, and third-party connectors. Another failure mode is over-centralising too quickly, which can interrupt production systems before replacement trust paths are ready. NHI Mgmt Group’s guidance on the Top 10 NHI Issues is useful here because it highlights how visibility, rotation, and offboarding problems cluster together rather than appearing in isolation.

For hybrid environments, the cleanest reductions in sprawl usually come from retiring duplicate service accounts, enforcing expiration on all new secrets, and using policy to reject identities that lack an owner or lifecycle date. That combination reduces the identity surface without forcing every platform into the same implementation model.

Related resources from NHI Mgmt Group

• How should security teams govern app identity modernization across multi-cloud environments?
• How should security teams choose an identity platform for hybrid and multi-cloud environments?
• How should security teams use CSPM to reduce cloud identity risk?
• How should security teams handle secret sprawl across cloud and AI workflows?