Blog
Cloud adoption has transformed how organizations deploy applications, store data, and deliver digital services. Users, applications, APIs, workloads, and automation platforms can now authenticate across multiple cloud and SaaS environments with little human interaction. But this flexibility has created a hidden security problem.
Organizations may know who their employees are and which applications they operate, yet still struggle to answer a basic question:
Who or what still has access to the environment today?
Cloud environments continuously accumulate user accounts, service accounts, workload identities, API keys, roles, permissions, and third-party integrations. Some are created for legitimate purposes and later forgotten. Others remain active after projects end, applications are retired, or responsibilities change.These identities and permissions may not be malicious, but they can still create exposure. They are the ghosts in the cloud. The challenge is no longer simply controlling access. It is maintaining visibility into which identities exist, what they can access, why that access exists, and whether it is still required.
The Cloud Identity Explosion
Applications, services, containers, automation pipelines, and APIs also require identities to operate. Common examples include service accounts, workload identities, API keys, access tokens, cloud roles, automation accounts, and OAuth-authorized applications. Research from CyberArk highlights the scale of this change, reporting that machine identities outnumber human identities by 82 to 1.The issue is therefore not simply the number of identities, but whether organizations can maintain effective governance across them. An identity created to support a temporary migration may remain active after the migration ends. A service account may retain permissions after an application changes. An OAuth integration may continue accessing corporate resources long after the original business need has disappeared. Traditional identity governance was designed primarily around workforce users. Joiner-mover-leaver processes, role-based access control, periodic access reviews, and authentication policies were built around people.Modern cloud environments have expanded that model.Over time, access accumulates.
How Forgotten Access Becomes an Attack Path
The presence of an unused identity is not automatically a security incident. The real concern is what happens when forgotten access can be exploited. Dormant identities can remain enabled after their original purpose has disappeared, creating unnecessary entry points.Privilege accumulation can occur when additional permissions are granted over time but older permissions are never removed. CISA guidance emphasizes least privilege and limiting accounts to the permissions required for their intended functions.Forgotten credentials create another risk. API keys, tokens, secrets, and other non-interactive credentials can continue working without regular human interaction. If compromised, they may provide direct access to systems or data. Third-party integrations add another layer. SaaS applications and external services increasingly receive access through OAuth, APIs, and delegated permissions. The application itself may be legitimate, but its access may no longer be necessary or appropriately restricted.
This creates an important distinction: Legitimate access can become a security risk when its purpose, ownership, or scope is forgotten.
The Hidden Risk: Permissions Do Not Exist in Isolation
Cloud permissions rarely operate independently.An identity may access an application. The application may access storage. The workload may access another cloud service. A credential associated with that workload may provide additional privileges.
Each permission may appear reasonable when reviewed separately.
Together, they may form an attack path.
This is why asking “Is this access authorized?” is no longer sufficient.
Security teams also need to ask:
“What can this identity ultimately reach?”
That requires organizations to understand relationships between identities, resources, applications, roles, and privileges rather than simply reviewing individual access assignments.
During cloud and identity assessments, Crossbow Cybersecurity frequently encounters environments where access is distributed across cloud platforms, SaaS applications, development environments, and automated workflows. Without centralized visibility, organizations can struggle to determine whether access remains appropriate or whether seemingly minor permissions combine into a meaningful exposure.
Why Traditional Access Reviews Can Miss the Ghosts
Periodic access reviews remain an important control, but they can provide only a partial view of modern cloud access. A review may confirm that a user belongs to an approved role without exposing every inherited permission. An inventory may identify a service account without showing whether it is still required or what downstream resources it can reach.
An organization may know which SaaS applications are approved without having complete visibility into every OAuth connection associated with them. This creates a gap between identity inventory and effective access.The problem becomes particularly difficult when identities are created dynamically, permissions are inherited across multiple policies, and access spans several platforms.
The objective should therefore move beyond asking:
“What identities do we have?”
and toward:
“Which identities have meaningful access to critical resources, and why?”
Governance and Compliance Considerations
Forgotten access is not only a technical issue. It also creates governance challenges. Security and compliance programs commonly require organizations to control access, apply least privilege, periodically review permissions, and maintain appropriate oversight of systems and information. Frameworks such as ISO/IEC 27001, NIST CSF, PCI DSS, and SOC 2 reinforce these principles. The challenge is demonstrating that those controls reflect the environment as it actually operates. An organization may have a documented access-review process while dormant identities remain outside the review population. It may have a least-privilege policy while service accounts retain broad permissions. It may perform periodic certifications while machine-to-machine and third-party access remains poorly documented. This highlights an important principle: Having an access-control policy is not the same as having visibility into actual access.
Hunting the Ghosts
Organizations can reduce this exposure by treating identity discovery and governance as an ongoing process.
Key measures include:
• Identify dormant, orphaned, and unnecessary identities.
• Establish ownership and business justification for privileged and machine identities.
• Review excessive and inherited permissions against critical resources.
• Monitor API keys, tokens, secrets, and third-party application access.
• Remove unnecessary privileges and implement appropriate credential rotation and expiration.
• Continuously monitor privileged and anomalous identity activity.
The objective is not to remove every unusual identity. Some identities are essential to applications and automation. The objective is to ensure that every significant identity has a clear purpose, accountable owner, appropriate permissions, and defined lifecycle. CISA recommends strong identity lifecycle management, least privilege, monitoring, and auditing of administrative activity to strengthen cloud security.
The Future of Cloud Identity Security
As organizations expand their use of cloud-native architectures, automation, APIs, and AI-enabled services, the identity landscape will become even more complex.
The focus of identity governance must therefore expand beyond employees to include the applications, workloads, services, and integrations that increasingly operate on an organization's behalf.
The question is no longer simply:
“Who has access?”
It is:
“Do we understand every identity and permission that can reach our critical assets?”
Organizations that can answer that question will be better positioned to reduce attack paths, strengthen governance, and respond to compromised identities before they become major incidents.
Conclusion
Eventually, the reason for that access may be forgotten.Cloud environments rarely become over-permissioned intentionally. Access accumulates. An identity is created for a project. A privilege is added to solve an operational problem. An application is connected to another service. A temporary permission becomes permanent. But the access remains.
These forgotten identities, permissions, credentials, and integrations create a hidden layer of exposure that conventional access reviews may not fully capture. Organizations need to move beyond maintaining identity inventories and start evaluating whether access is necessary, appropriate, owned, monitored, and still justified.
Crossbow Cybersecurity helps organizations assess identity and access governance across cloud and SaaS environments, identify unmanaged or excessive access, and strengthen visibility into the relationships shaping their modern attack surface. Because in a cloud environment, the greatest risk may not be the identity you know.
It may be the one you forgot existed.
References
Cybersecurity processes are required to be baked into an organizations day-to-day processes for seamless adoption. Identify what is best for you.
We can help. Connect with us – we always love having a chat.
