Custom Views

Custom views are saved, role-specific ways of displaying security data by applying filters, adjusting columns, and organizing information to match operational needs. They help administrators reduce noise, focus on the most relevant entities, and work more efficiently across monitoring, investigation, and reporting tasks.

Expanded Definition

Custom views are not a separate security control; they are a governance and workflow layer that shapes how identity and telemetry data is presented to specific operators. In NHI and agentic AI environments, a custom view typically combines saved filters, tailored columns, scoped entity lists, and role-aware sorting so that administrators, responders, and auditors see the records most relevant to their tasks. That makes them useful for triage, privilege review, anomaly hunting, and reporting, especially where service accounts, API keys, and agent actions generate high-volume signals.

Usage in the industry is still evolving. Some platforms treat custom views as personal analyst preferences, while others promote them as reusable operational templates. The practical distinction is whether a view merely changes convenience or also enforces a consistent operating lens for a role. For example, a view can be designed to surface expired secrets, orphaned NHIs, or recently privileged agents without requiring each operator to rebuild the same query. For broader context on why filtering matters in this domain, see the Ultimate Guide to NHIs and the NIST Cybersecurity Framework 2.0.

The most common misapplication is treating a custom view as an access boundary, which occurs when teams assume a filtered display prevents underlying data exposure.

Examples and Use Cases

Implementing custom views rigorously often introduces consistency overhead, requiring organisations to balance operator speed against the risk of fragmented visibility across teams.

• A SOC analyst saves a view that shows only high-risk service accounts with recent privilege changes, reducing noise during incident triage.
• An IAM administrator creates a role-specific view for expired API keys, inactive workloads, and overdue rotation events to support remediation workflows. Guidance on lifecycle hygiene is reinforced in the Ultimate Guide to NHIs.
• A compliance reviewer uses a reporting view with columns for owner, last rotation date, vault status, and environment tags to accelerate evidence collection.
• An NHI operations lead builds a view focused on third-party exposed identities so supplier risk can be reviewed separately from internal workloads, consistent with identity governance principles in NIST Cybersecurity Framework 2.0.

In mature programs, custom views are often paired with saved investigations, because repeatable filtering makes it easier to compare the same subset of entities over time. They are especially helpful when different teams need different lenses on the same dataset without changing the underlying source of truth.

Why It Matters in NHI Security

Custom views matter because NHI environments are often too noisy for broad, undifferentiated monitoring. NHIMG reports that only 5.7% of organisations have full visibility into their service accounts, and that visibility gap is exactly where well-designed views can reduce search time and improve response quality. A good view does not create security by itself, but it helps teams focus on the entities most likely to carry risk, such as overprivileged NHIs, stale secrets, or unrotated credentials. The same operational logic applies to agentic AI, where tool-using agents can generate large volumes of actions that need to be grouped by role, environment, or blast radius.

Custom views also support governance. They help standardise what “important” looks like for a given function, which makes reviews more repeatable and audit evidence easier to assemble. That said, a view can also hide risk if it filters too aggressively or if different teams rely on incompatible saved configurations. For that reason, view design should be reviewed as part of the broader visibility and access strategy described in the Ultimate Guide to NHIs and aligned to the outcome-driven approach of NIST Cybersecurity Framework 2.0.

Organisations typically encounter the need for custom views only after an investigation, audit, or outage reveals that standard dashboards could not isolate the affected NHIs quickly enough, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• When should organisations add custom reporting capabilities instead of relying on standard analytics views?
• When should organisations prefer standards over custom implementations?
• When do custom IAM roles become a governance problem?
• How should security teams choose between basic, predefined, and custom GCP IAM roles?