Cloud security teams face a list that never ends. Can reducing unnecessary access stop the same problems returning?