The Control Plane Is the Perimeter: Cloud Security in 2026

For a decade, cloud security advice was a list of misconfigurations: the public storage bucket, the security group open to the world, the database with no password. Those problems are still real, and finding them is still worth doing. But they are no longer where the interesting failures happen. Look at the cloud incidents that defined 2026 and the pattern is consistent: nobody exploited a vulnerability in the provider's infrastructure. An identity with too much standing access did exactly what it was permitted to do.

Workload Identity Replaced the Access Key

The long-lived access key is the clearest example of a control that everyone agrees is wrong and most estates still contain. A key created for a proof of concept in 2021 has no owner, no rotation and no expiry, and it grants whatever it was granted then. The replacement is workload identity federation: the workload proves what it is to the platform through a signed token from the environment it runs in, and receives short-lived credentials scoped to a role. There is nothing to steal that remains useful, nothing to rotate, and the permission set is visible in a role definition rather than buried in a developer's notes.

Getting there is less about tooling than about inventory. Which workloads still hold static keys, which of those keys have been used in the last ninety days, and which have never been used at all. The last category is usually the largest and the easiest to remove. Secrets scanners will find keys in repositories; they will not find the ones pasted into a CI variable six years ago and inherited by every fork since.

OAuth Grants Are the Quiet Privilege Path

SaaS-to-SaaS authorisation has become the most under-inspected permission model in most organisations. A user consents to a third-party application, the application receives a token, and the token can often read mail, files or directory data indefinitely. The user sees a consent screen once. The security team sees nothing unless it has configured consent policy and review.

In April 2026, Vercel was breached through a third-party AI tool whose Google Workspace OAuth application had been compromised. That grant let the attacker take over an employee's Workspace account and reach the environment variables that were not marked as sensitive. The details matter less than the shape: no exploited server, no credential stuffing, just a legitimate grant doing what it was allowed to do from an unexpected place. The controls are administrative and boring. Restrict user consent to verified publishers, route new grants through an approval workflow, review existing grants quarterly, cap token lifetimes, and monitor for grants created from unusual locations or by accounts that have never used the application before. For anything holding mail or file access, require the grant to be tied to a group rather than to an individual.

The Admin Plane Is Internet-Facing by Design

Cloud consoles, device management portals and identity providers are reachable from anywhere because that is the product. In March 2026, an actor using compromised Entra ID Global Administrator credentials issued a legitimate Intune remote-wipe command and erased an estimated 80,000 devices across 79 countries in about three hours. Nothing was exploited. The attacker logged in and used the feature as designed.

The lesson is not that remote wipe is dangerous. It is that a single administrative identity can act at fleet scale, and most organisations protect it with the same authentication as an ordinary mailbox. Administrative accounts need phishing-resistant authentication with no SMS or voice fallback, just-in-time elevation rather than standing Global Administrator, separate accounts and devices for administration, conditional access that constrains where the console can be reached from, and multi-admin approval for destructive operations. Microsoft's Intune supports approval workflows for exactly this reason; enabling them is a configuration change, not a project.

CI/CD Is a Production Identity

Build systems hold credentials to artifact registries, cloud accounts and deployment targets, and they run code contributed by people and, increasingly, by agents. A pipeline that can deploy to production is a production identity and should be treated as one: scoped per environment, short-lived, unable to read production data, and monitored for outbound connections it has no reason to make. The build runner that suddenly opens a connection to an unfamiliar object store is a detection opportunity, and most organisations are not looking.

What to Measure

• Standing keys: count of long-lived cloud credentials, and how many have been used in ninety days.
• Grants: percentage of OAuth applications reviewed in the last quarter, and how many can read mail or files.
• Admins: percentage of administrative accounts with phishing-resistant authentication and no standing role.
• Time to revoke: measured minutes from decision to a token being unusable everywhere.

Configuration scanning still has a place, but its findings should be ranked by whether they sit on a path to a privileged identity, not by severity label. The bucket that is public and empty is less interesting than the role that can assume another role. In 2026 the perimeter is not the network edge and it is not the account boundary either. It is the set of identities that can change state, and the consoles that control them.