The difference between what a security team has documented and what is actually reachable, exposed, or exploitable in the environment. This gap widens when ownership, identity trust, and external exposure are managed separately.
Expanded Definition
Reality gap describes the distance between an organisation’s recorded security posture and the state of systems, identities, and exposures that can actually be reached in production. It is not simply a documentation problem. In practice, the gap appears when inventories are stale, ownership is unclear, cloud assets are spun up outside normal change processes, or identity permissions outpace review cycles. For NHI Management Group, the term is especially relevant where human and non-human identities, service accounts, and external integrations are governed separately, because the resulting overlap often hides what is truly exposed.
The concept aligns closely with the intent of the NIST Cybersecurity Framework 2.0, which emphasises knowing assets, protecting access, and maintaining continuous governance rather than relying on periodic snapshots. Industry usage is still evolving, so definitions vary across vendors and practitioners, but the core idea is consistent: the operational environment has drifted away from the model used to manage it. The most common misapplication is treating reality gap as a reporting discrepancy, which occurs when teams assume a clean inventory means exposures, permissions, and attack paths are also under control.
Examples and Use Cases
Implementing reality-gap reduction rigorously often introduces continuous discovery overhead, requiring organisations to weigh faster visibility against the cost of always-on monitoring and reconciliation.
- Cloud security teams find a public storage bucket that was removed from the asset register but remained reachable because an orphaned policy still allowed access.
- Identity teams discover a service account with broad permissions that was never reassigned after an application migration, creating hidden privilege beyond the documented baseline.
- Exposure management identifies an internet-facing API gateway that was approved for testing months ago, but the temporary exception never expired and was not tracked back into the risk register.
- Security operations link a developer-owned machine identity to a production workflow that no one formally documented, revealing a trust path that bypasses expected approval gates.
- Governance teams reconcile a CMDB with actual cloud resources and discover that several assets exist outside NIST SP 800-53-style control expectations for ongoing configuration control and monitoring.
Reality gap is also common during mergers, rapid cloud adoption, and IAM redesigns, when the organisation’s view of assets and identities moves more slowly than the environment itself. Where teams rely on point-in-time attestations, the gap often grows unnoticed until an external scan, incident review, or audit challenge forces the mismatch into view.
Why It Matters for Security Teams
Reality gap matters because attackers do not target the security programme’s records. They target what is actually exposed, reachable, and trusted. When the documented control set diverges from the live environment, teams can overestimate coverage, miss attack paths, and misplace remediation effort. That affects vulnerability management, cloud posture, identity governance, and incident response at the same time. The concept also intersects with non-human identity security: unmanaged secrets, stale tokens, and forgotten service accounts can preserve access long after the application owner believes the exposure has been removed.
From a governance perspective, closing the gap means combining asset discovery, entitlement review, exposure validation, and ownership confirmation into a single operational loop. That is consistent with NIST Cybersecurity Framework 2.0 thinking, and it also complements identity assurance principles in NIST SP 800-63 when digital identities are part of the access path. Teams that ignore the issue tend to discover it only after a breach review, at which point reality gap becomes operationally unavoidable to resolve.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-1 | CSF asset management highlights the need to know what is actually in the environment. |
| NIST SP 800-53 Rev 5 | CM-8 | CM-8 requires inventory of information systems, which is central to closing reality gaps. |
| NIST SP 800-63 | IAL2 | Digital identity assurance becomes relevant when identity records diverge from actual trust paths. |
| OWASP Non-Human Identity Top 10 | NHI governance addresses stale secrets and service accounts that create hidden reachability. |
Track non-human identities as active access paths and retire them when use is no longer justified.
