Risky identities continue to plague cloud infrastructures

The cloud looks like a fancy and futuristic place; a white room where things simply exist. However, as anyone who has dealt with it knows, in reality it’s a tangle of services, humans, and machines, all regulated by permissions and access control.

Cloud identities provide access to users and machines so they can build and maintain the infrastructure, while establishing who is allowed to do what, where, and for how long.

Our 2026 Cloud-Native Security and Usage Report reveals that, despite its critical role, cloud‑native identity management remains one of the most persistently misconfigured and poorly governed areas of security. AI is creating more challenges by increasing the scale at which identities must be managed, but it could also be the solution we’ve needed to bring order to this mess.

Let’s take a sneak peek at our report and analyze the issues with cloud identities, review the current trends, and explore security best practices you can start implementing today.

Cloud identities are often misconfigured

Cloud services have gradually become the backbone of both small businesses and large corporations. So much so that for many companies, one provider is not enough. Although AWS remains the preferred option, 24% of organizations maintain identities across more than one CSP.

With such an important role, we find it both surprising and slightly alarming how often cloud identities are still misconfigured. The most common culprits are overly permissive identities, those that provide access for long periods of time even when they remain unused, and access without multifactor authentication.

We’ve found that on average, 67% of user identities are considered risky across all CSPs.

The machine identity explosion

Even though humans account for less than three percent of identities in a cloud environment, they still somehow manage to cause an absurd share of cloud security problems. But let’s not let that overshadow the fact that a whopping 97.2% of managed identities within CSPs belong to machines.

This is primarily a consequence of how a cloud is architected. Cloud providers offer hundreds of microservices that developers can assemble as building blocks into a full application. Let’s see a fictional example of how this works in practice:

1. Paula sends a picture to Eric on a messaging app.
2. Before it is delivered to Eric, this message is processed by a chunk of code (a computing service) that performs several checks, like ensuring that Paula has permission to message Eric.
3. If all is correct, the image will be archived (in a storage service).
4. Next, the message is registered (in a database service).
5. Then the code deposits the message into a queue (a messaging queue service) so another service (a mobile push service) can deliver a notification to Eric.

By default, none of these services can talk to each other. DevOps engineers need to assign roles to each service to define who can talk to each other, and what they are allowed to do.

In addition, there are myriad external services that interact with a cloud environment via its API. This includes infrastructure-as-code tools that automate the creation of these services, security platforms like Sysdig that watch over the infrastructure, or AI agents that gather data from multiple sources to perform complex tasks.

With all this in mind, it’s easy to see how cloud environments are overwhelmed by machine identities. This is exactly how their access and permissions can quickly scale and get out of hand. The numbers show the consequences of this growth, as around 40% of machine identities maintain some level of risk such as admin or edit privilege, user-managed keys, or inactivity. 

Identity is the cloud‑native perimeter

As we just discussed, the paradigm has shifted. Identity and access management (IAM) is now the equivalent of network firewalls, but for implementing zero-trust and least-privilege principles.

Companies still need to catch up, and they must do so fast, as AI is shifting the scale of the problem. Unlike microservices, where each workload has limited access and responsibilities, AI agents need access to many subsystems to cross-reference data and perform complex tasks. As a result, they also have a great deal of power to cause harm.

Luckily, this is not a new problem. We humans may not always be great at managing identities at a scale, but we’ve also learned a lot. For example, we know that periodic reviews and static policies are not enough. By contrast, continuous analysis, contextual understanding of behavior, and automated enforcement are reliable practices for identifying and addressing threats on time. And that’s exactly the kind of work where agentic AI shines, making it a powerful potential solution to the longstanding problem of IAM.

Cloud identity and access management best practices

Here’s what you can do right now to improve your identity and access management.

• Apply the principle of least privilege dynamically:
  • Don’t trust static policies automatically.
  • Continuously monitor identity behavior and alert on unexpected actions or privilege escalations.
• Keep your house clean:
  • Use policy controls to block unauthorized high‑risk permissions.
  • Define parameters for unused or rarely used permissions and automate their removal.
  • Consolidate identity management in multicloud environments to rescue duplicated accounts and inconsistent policies.
• And finally, limit access to specific time frames:
  • Use temporary privilege escalations and just-in-time accesses.
  • Rotate or eliminate long‑lived keys in favor of short‑lived and autonomously rotated credentials.

In conclusion

While cloud identities are the new “firewall” of modern infrastructure, they remain one of the most persistently misconfigured and poorly governed areas of security.

The modern cloud perimeter requires continuous analysis, contextual understanding of behaviors, and automated enforcement. These conditions are exactly where agentic AI shines. The few organizations that are starting to figure this out are reducing risk and are operating at a security level everyone else is still trying to reach. 

Get more insights in our 2026 Cloud-Native Security and Usage Report.

2026 Cloud-Native Security and Usage Report

Read the full report