Why 92% of Cloud Permissions Are Never Used, and What That Costs You

This blog post summarizes Sonrai’s analysis showing that on average 92% of identities with sensitive cloud permissions go unused over 90 days, explains how non-human identities, acquisitions, and AI agents drive permission sprawl, details the resulting risks (larger attack surface, higher breach costs, audit liability, and engineering overhead), and advocates quarantining unused permissions and using permissions-on-demand (JIT for permissions) to reduce exposure without breaking production.