<p“What do you trust more: the people who log in, or the tokens that log in for them?” That is the modern dilemma for every organization moving to the cloud, and the answer is getting harder by the day. ReliaQuest’s recent data shows identity-related issues accounted for 44% of cloud security alerts in Q3 — a startling figure that forces CISOs, developers and regulators to ask whether identity has quietly become the cloud’s primary vulnerability.
Cloud architectures promised speed, scale and efficiency. They delivered — along with a sprawling identity surface that mixes human users, service accounts, CI/CD tokens, API keys, and now autonomous AI agents. When identity is fractured, attackers find low-friction paths to high-value targets: leaked tokens redeploy malicious code, over‑privileged roles expose entire data stores, and misconfigured federations let adversaries impersonate legitimate services. Analysts have warned that non-human identities will soon outnumber human accounts in many enterprises, making governance and visibility urgent priorities .
Background: how identity became central
Identity is the currency of cloud trust. Single sign-on, role-based access control, workload identity federation and ephemeral tokens form the plumbing that ties services together. But that plumbing is complex and often invisible. Credentials live in code, configuration files, container images, build pipelines and forgotten cloud projects. Long‑lived keys accumulate permissions over time; ownership of a machine identity may be ambiguous when projects end or when automation creates accounts without clear business owners. These gaps create a catalogue of targets that adversaries can exploit without ever cracking a password in the traditional sense .
What the data says now
ReliaQuest’s finding that 44% of cloud security alerts stem from identity issues is not just a statistic; it’s an operational alarm bell. It reflects real incidents and near-misses where identity tokens, credentials and misconfigurations generated the majority of detectable cloud risk signals. Complementing real‑world incidents, recent disclosures — such as a token‑handling flaw in a major identity provider — illustrate the systemic potential for forged or improperly validated tokens to enable cross‑tenant impersonation if not rapidly mitigated .
Why identity problems produce outsized impact
-
Privilege concentration: A single over‑privileged service account or API key can provide broad lateral movement across cloud resources, multiplying the damage of a compromise.
-
Opacity of non‑human identities: Machine identities are created and forgotten; without continuous inventory, teams simply don’t know what exists or who owns it .
-
Automation and scale: DevOps velocity, third‑party integrations and automated agents accelerate both legitimate operations and the speed at which a compromised identity can act .
-
Tooling and detection gaps: Security systems generate noise and false positives, making it difficult to prioritize genuine identity threats among thousands of alerts.
Perspectives from the field
Technologists see the problem as both technical and cultural. Engineers value uptime and rapid delivery; developers prize convenience. That incentive mix favours long‑lived tokens and permissive roles unless organizations build identity hygiene into developer workflows. Security teams advocate for inventory, least privilege and monitoring — but admit those controls add friction without tight integration into CI/CD and provisioning systems .
Policymakers and regulators view opaque identity governance through a different lens: compliance risk. Laws and sector rules increasingly demand demonstrable access controls and data flow governance. When identities are unmanaged or undocumented, proving regulatory compliance becomes difficult or impossible, increasing legal and reputational exposure for organizations that cannot show who or what accessed sensitive data .
End users want privacy and continuity. They expect services to “just work” while also expecting their personal data to remain secure. Breaches that exploit identity failures can undermine user trust far faster than purely technical outages — especially when third‑party tokens or vendor service accounts are involved.
Adversaries, of course, welcome complexity. Long‑lived credentials, misconfigured roles, and hidden automation create low‑cost, low‑visibility opportunities. The incentive structure for attackers is simple: compromising a service account or stealing a token often yields richer access than chasing a single user credential.
Practical mitigations that work — and why adoption lags
Security practitioners advocate a set of practical, well‑understood controls, and yet implementation is uneven.
-
Comprehensive inventory and visibility: Discover and catalog every non‑human identity across cloud accounts, CI/CD pipelines and third‑party services. Treat inventory as a living dataset updated by deployment tooling and pipelines .
-
Least privilege and role hygiene: Define narrow roles, avoid undifferentiated “owner” roles and require just‑in‑time elevation for sensitive operations .
-
Short‑lived credentials and federation: Move away from static keys toward ephemeral tokens and workload identity federation to reduce the window of exposure .
-
Secrets management and code hygiene: Centralize secrets in vaults, scan IaC and container images for embedded credentials, and automate rotation and audit logging .
-
Behavioral analytics and monitoring: Log every action, correlate activity to baselines and alert on anomalous behavior such as unusual cross‑account access or atypical data movement .
-
Ownership and lifecycle governance: Assign business owners, require justification and bake deprovisioning into project closure and CI/CD workflows .
But obstacles remain. Tooling alone is insufficient. Organizations must change incentives so developers treat identity hygiene like code testing, balancing speed against sustained risk. Short‑lived tokens and automated remediation can introduce operational complexity and outages if inventory and ownership aren’t nailed down first — a source of reluctance for many teams .
Strategic implications
Identity as the dominant cloud risk reshapes priorities. Security budgets and roadmaps must shift from perimeter and network defenses to identity lifecycle management: discovery, governance, and continuous attestation. Vendors and platform providers will face pressure to deliver stronger default posture, better visibility into non‑human actors, and safer token issuance practices — as recent token‑validation disclosures have already demonstrated .
For regulators, the rise of identity‑driven incidents will likely prompt guidance on non‑human identity governance, minimum token lifetimes, and vendor disclosure responsibilities. For boards and executives, the message is clear: identity incidents can be disproportionately consequential and deserve oversight beyond traditional IT reporting lines.
Conclusion
Identity is no longer a narrow technical problem — it is the fulcrum of cloud risk. The 44% figure reported by ReliaQuest is a warning and an opportunity: invest in inventory, least privilege, ephemeral credentials and cross‑functional governance now, or expect identity failures to keep driving your next major cloud incident. If the cloud’s perimeter is identity, what are you doing today to make sure the keys in your environment don’t open doors for someone else?
Source: https://www.infosecurity-magazine.com/news/identity-is-now-the-top-cloud-risk/
