How CNA Insurance eliminated GCP service account sprawl with Zero Standing Privilege

Key takeaways

• CNA Insurance manages 1,000+ live GCP projects and had accumulated 40,000+ service accounts growing at 5% per month.
• Existing IGA, CSPM and native GCP tooling could not provide the visibility or governance CNA needed at that scale.
• With P0 Security, CNA connected all 1,000+ GCP projects in under one hour with zero additional infrastructure.
• 100% of static keys and overly permissive service account access were eliminated within weeks of deployment.
• CNA now operates a Zero Standing Privilege model: new service accounts are short-lived and least-privileged by default.
• Time to value with traditional vaults or bastions would have taken several months and achieved only ~70% risk reduction.

How did CNA Insurance solve GCP service account sprawl?

CNA Insurance used P0 Security to bring 40,000+ unmanaged GCP service accounts under continuous privileged access control. P0 connected all 1,000+ GCP projects in under one hour through native APIs, with no additional infrastructure. Within weeks, CNA eliminated 100% of static keys and overly permissive access, replacing standing privilege with just-in-time access and automated key rotation. The 5% monthly sprawl growth rate was halted and reversed.

Service account sprawl is one of the most common ways standing privilege accumulates in modern cloud environments. Rather than periodically discovering and cleaning up excess access, CNA established a continuous model for authorizing privileged access, enforcing least privilege by default as new service accounts were created.

By the numbers: CNA Insurance's NHI challenge at a glance

About CNA Insurance: Managing risk at enterprise scale

CNA Insurance is one of the largest commercial property and casualty insurers in the United States, operating across 1,000+ active Google Cloud Platform (GCP) projects. The company offers a broad range of standard and specialized insurance products, helping organizations manage risk and protect their people, assets and operations.

As a regulated financial services organization, CNA faces heightened scrutiny on access governance from SOC 2, NIST CSF and state insurance regulators. Every audit requires proof of who accessed what, when and why. That requirement extends to non-human identities, not just human users.

The challenge: 40,000 unmanaged service accounts across 1,000 GCP projects

CNA had accumulated 40,000+ service accounts across its GCP environment, growing at 5% per month. That translates to roughly 2,000 new accounts added every 30 days with no end in sight. Alongside those accounts sat 30,000+ static keys, many of which had not been rotated in months or longer.

Service account sprawl is a structural challenge in cloud environments. Developers create service accounts to build and ship software. Over time, those accounts accumulate permissions, outlive the engineers who created them and hold overly broad access that nobody tracks. CNA's existing IGA, CSPM and native GCP tooling could not provide the visibility or governance needed at this scale.

For context on why this problem is so common, see the rise of non-human identities and the future of PAM.

Three specific problems made the situation unmanageable:

1. No accountable owners: Service accounts without humans behind them

When a developer creates a service account and then moves to a different team or leaves the company, the account persists with no owner. The credentials remain active, the permissions remain broad, and there is no human accountable for the account or what it can access.

Across 40,000+ accounts, these accountability gaps made remediation impossible. You cannot safely delete or downscope a service account if you do not know what it does or who depends on it. Service account sprawl occurs when non-human identities accumulate faster than ownership and governance processes can track them, creating persistent privileged access with no accountable human owner.

2. No visibility into what service accounts could access or were doing

Without posture data showing what permissions each account holds and whether those permissions are actually being used, every remediation attempt carries risk. Revoking access from the wrong account could break production.

CNA's existing tooling all failed at this scale. Google Cloud IAM shows what permissions exist but not which are actually being used, which accounts are idle or which keys have not been rotated. Service account visibility means knowing, for every non-human identity, what permissions it holds, when it last authenticated, what resources it accessed and who is responsible for it. According to Sophos State of Identity Security 2026, weak NHI management was a root cause in 41% of successful identity breaches in 2026.

3. Homegrown fixes that could not scale: The hidden cost of manual NHI governance

CNA's security team had built homegrown tooling to manage the sprawl, but at 40,000+ accounts the effort was cumbersome, error-prone and required significant FTE investment. At even five minutes per service account review, 40,000 accounts equals 3,333 hours of manual work. That is equivalent to 1.6 full-time employees working on nothing else.

The core issue was not effort but architecture. IGA was designed for human identities. CSPM covers configuration posture, not identity lifecycle. Native GCP tools lack cross-project aggregation. None of these were built to govern the lifecycle, usage and permissions of non-human identities at the scale CNA needed.

The solution: Continuous privileged access control across 1,000+ GCP projects

CNA connected all 1,000+ GCP projects to P0 Security using a single script in P0's web GUI. Deployment took less than one hour with zero additional infrastructure.

That deployment speed matters. With a vault or bastion approach, equivalent coverage would have taken several months and delivered only ~70% risk reduction. P0's agentless, API-first architecture eliminated the infrastructure overhead entirely.

See how this approach compares to legacy tools in why enterprises are upgrading to next-gen PAM for cloud security.

CNA used four P0 capabilities to transform how it managed privileged access for service accounts:

1. Discovering the access needed to eliminate standing privilege

On day one, P0 discovered all 40,000+ service accounts, their permissions, usage history and key status automatically through GCP APIs. That identity context gave CNA the confidence to eliminate standing privilege safely across its cloud environment without manual inventory, tagging or additional infrastructure.

P0's identity graph maps every NHI back to its associated human owner, enabling accountability without manual inventory work. P0 Security discovers all non-human identities across GCP projects automatically via native APIs.

2. Risk-based remediation: Identifying and eliminating over-privileged accounts

P0 prioritized the service accounts that represented the greatest standing privilege risk, including over-permissioned identities, unused keys and orphaned credentials. Rather than reviewing 40,000 accounts manually, CNA focused first on the access paths that created the largest potential blast radius.

The outcome: 100% of static keys removed. Overly permissive access eliminated across the entire GCP environment.

"With P0, we were able to get our arms around a massive service account problem without adding infrastructure or creating a long deployment cycle." - CNA Senior Security Engineer

3. Automated key rotation and permission removal at scale

P0 uses managed service accounts to automate key rotation and permission removal. CNA's team did not need to handle credentials manually at any point in the process.

Manually rotating more than 30,000 keys isn't a sustainable security strategy because the larger challenge is ensuring service accounts have only the permissions they need. While vaults help manage credentials, they don't eliminate standing privilege. P0 enabled CNA to replace persistent permissions with temporary, least-privileged access, granting service accounts only the permissions required for each workload.

4. Just-in-time developer access: removing standing privilege without slowing teams down

Developers who need temporary access to production resources request it through P0's automated approval workflow. They get exactly the access they need, for exactly as long as they need it, and it is revoked automatically. JIT access through P0 is faster than filing a ticket to a shared admin account and waiting for manual approval. For a deeper look at how this works, see just-in-time ephemeral database access.

By replacing standing access with just-in-time access, CNA eliminated persistent production permissions for both service accounts and developers. Privileged access now exists only when it's needed and is automatically revoked when the task is complete, putting Zero Standing Privilege into practice.

The results: From 40,000 unmanaged accounts to 100% static key elimination

• 100% of static keys removed across all 1,000+ GCP projects
• 40,000+ service accounts brought under continuous privileged access control
• Deployment completed in under 1 hour with zero additional infrastructure
• Continuous privileged access controls established: new accounts are short-lived and least-privileged by default
• 5% monthly sprawl growth rate halted and reversed

The contrast with the alternative is significant. A traditional PAM or vault approach would have taken several months to deploy and delivered only partial risk reduction of about 70%. P0 delivered complete coverage in under one hour.

CNA went from 40,000+ unmanaged GCP service accounts to eliminating 100% of static keys and overly permissive access. More importantly, CNA now has a sustainable program to keep it that way.

Why standing privilege continues to grow in cloud environments

CNA's story is not unique. It reflects a structural challenge facing every organization running workloads at scale in the cloud. As cloud-native applications, Kubernetes workloads, CI/CD automation and AI agents proliferate, the number of service accounts and other non-human identities continues to grow. Without continuous controls, standing privilege expands alongside them.

The numbers paint a clear picture:

Non-human identities now outnumber human identities by ratios as high as 100:1 in enterprise environments, and only 34% of organizations regularly audit or rotate service accounts and NHIs (Sophos, 2026).

GitGuardian's State of Secrets Sprawl 2026 report found that 29 million hardcoded secrets were exposed on public GitHub in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded. Internal repositories are six times more likely to contain hardcoded secrets than public ones.

For regulated organizations like CNA, the challenge extends beyond reducing operational risk. Auditors increasingly expect organizations to demonstrate who or what accessed sensitive systems, when that access occurred, and whether it was appropriate. That includes service accounts, API keys, and workload identities. Eliminating standing privilege makes that level of accountability far easier to achieve.

For organizations evaluating how to extend governance to AI agents as well, see P0's approach to agentic access control.

Standing privilege is no longer sustainable in the cloud

CNA's journey maps a path from service account sprawl to Zero Standing Privilege. By discovering every service account, eliminating persistent permissions and replacing them with policy-driven, just-in-time access, CNA established a sustainable operating model for privileged access across its Google Cloud environment.

Traditional approaches often require months to deploy while still leaving organizations with standing privileged access to manage. In 2026, service account sprawl is not a backlog item. It is an active attack surface that compounds every month it goes unaddressed. CNA's story shows what is possible when privileged access becomes temporary, policy-driven and continuously controlled.

See how this same model extends to privileged access control for AI agents.

See how P0 can govern your cloud service accounts: request a demo  |  Download the original CNA case study PDF

Frequently asked questions about GCP service account governance

What is service account sprawl?

Service account sprawl occurs when non-human identities, also known as machine identities, such as GCP service accounts, accumulate across cloud environments faster than governance processes can track, own or manage them. In Google Cloud, service accounts are the primary non-human identities used by applications, workloads and automation to authenticate and access cloud resources. Over time, orphaned accounts with static keys and excessive permissions create a growing attack surface that is invisible to standard IAM and CSPM tools.

Why can't native GCP tools solve service account sprawl?

Native GCP tools like IAM and Cloud Asset Inventory provide permission data but lack cross-project aggregation, usage analytics, ownership mapping and automated remediation workflows. They show what permissions exist, not which are being used, which accounts are orphaned or which keys have not been rotated. Governing 40,000+ accounts across 1,000+ projects requires a dedicated NHI governance platform.

How long does it take to deploy P0 Security for GCP?

CNA Insurance connected all 1,000+ GCP projects to P0 Security in under one hour using a single script in P0's web GUI, with no additional infrastructure required. Traditional vault or bastion-based approaches for equivalent coverage typically take several months to deploy.

What is the difference between IGA, CSPM and NHI governance?

Identity Governance and Administration (IGA) manages human identity lifecycle and access certification. Cloud Security Posture Management (CSPM) monitors cloud configuration risks. Neither was designed to govern the lifecycle, usage and permissions of non-human identities at scale. NHI governance fills this gap by providing continuous discovery, risk assessment, ownership mapping and automated remediation for service accounts, API keys and machine identities.

What is standing privilege?

Standing privilege refers to permissions that remain continuously assigned to an identity, even when they are not actively needed. For service accounts, standing privilege increases the attack surface because compromised credentials can be used immediately. Continuous privileged access control replaces standing privilege with temporary, task-specific access through ephemeral credentials that are automatically revoked.

What does zero standing privilege mean for service accounts?

Zero Standing Privilege (ZSP) for service accounts means no non-human identity holds persistent elevated permissions by default. Access is granted through ephemeral credentials or temporary permission elevation, scoped to a specific task, for a defined duration, and automatically revoked when the task ends. This eliminates the standing privilege risk that makes compromised service accounts dangerous.

How does just-in-time access work for GCP service accounts?

With just-in-time (JIT) access, developers and automated workloads request temporary, scoped permissions through an automated approval workflow rather than holding standing access. P0 Security issues ephemeral credentials or temporarily elevates permissions for the duration of the task, then automatically revokes them. Service accounts never hold more access than each specific task requires. Learn more about JIT access at p0.dev/about.

Sources and references

1. Sophos. The State of Identity Security 2026. sophos.com
2. GitGuardian. The State of Secrets Sprawl 2026. March 2026. blog.gitguardian.com
3. Google Cloud. Best Practices for Managing Service Accounts. cloud.google.com