Identity and access management is where cloud breaches actually happen. Not the firewall, not the patch level, the over-broad role that someone created in a hurry and nobody ever walked back.
Every project adds a role. Every incident adds a temporary grant that becomes permanent. Over time your cloud accumulates a web of permissions that no single person understands, and any one of them can be the path an attacker takes from a minor foothold to full control.
When we assess a cloud environment, we trace the privilege paths: if an attacker lands here, where can they get? The findings are rarely exotic. They are almost always a permission that made sense once and was never removed. Closing them is unglamorous, and it is the highest-leverage work in cloud security.