Continuous identity management is the missing control plane

At a glance

What this is: Opal Security makes the case that identity management still behaves like a compliance process, not a continuous security control, and that this leaves access drift and over-provisioning exposed between reviews.

Why it matters: IAM teams responsible for NHI, autonomous, and human access need continuous visibility because audit-only controls cannot keep pace with privilege change, standing access, and real-time risk.

👉 Read Opal Security's analysis of continuous identity management and access drift

Context

Identity security is the set of controls that govern who or what can access systems, data, and actions. In this article, Opal Security argues that most organisations still manage identity through quarterly or yearly user access reviews, even though other security functions are monitored continuously.

The core governance gap is temporal: point-in-time review assumes access risk can wait for an audit cycle. That assumption fails when privilege drift, over-provisioning, and active misuse can emerge and be exploited between reviews, especially in programmes that still treat identity as a compliance sub-function.

Key questions

Q: What breaks when quarterly access reviews are used for non-human identities?

A: Quarterly access reviews break when applied to non-human identities because the control assumes stable identities, known ownership, and slow entitlement change. Service accounts, workload identities, and ephemeral tokens can be created outside formal workflows and change faster than the certification cycle, so the review documents history rather than governing live access.

Q: Why does over-provisioned access become more dangerous in healthcare identity environments?

A: Over-provisioned access increases the blast radius of human error, misuse, and compromised accounts. In healthcare, that risk is amplified by fragmented systems, static entitlements, and limited visibility into why access exists. When teams cannot see or explain access decisions clearly, they struggle to enforce least privilege, protect sensitive records, and prove compliance under pressure.

Q: How should teams decide which access should be just-in-time?

A: Use just-in-time access for permissions that are high impact, infrequently needed, or sensitive enough that standing privilege creates unnecessary exposure. Keep persistent access only where operational continuity genuinely demands it. The decision should be based on task criticality, data sensitivity, and how quickly the risk changes during execution.

Q: How can security teams know if cloud identity governance is actually working?

A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review. If teams still spend days reconstructing access state, governance is not operating continuously. Effective programmes can show current MFA coverage, role scope, and credential age on demand.

Technical breakdown

Why point-in-time user access reviews leave exposure windows

User access reviews are periodic certifications of existing access, usually performed quarterly or yearly. They are built to confirm whether a user should still have access at a snapshot in time, but they do not continuously observe how access is used, whether entitlement scope has changed, or whether new risky combinations have appeared since the last review. That makes them structurally weak against fast-moving privilege drift. When access is over-provisioned on day one, or when a role changes without immediate recalibration, the audit model leaves an interim exposure window open. Security programmes that depend on delayed certification are always behind the live state of privilege.

Practical implication: treat access review as a governance backstop, not the primary detection and control layer for active entitlement risk.

How over-provisioning and birthright access create identity blast radius

Over-provisioning happens when users receive more access than they actually need, often through birthright access patterns where job title or team membership substitutes for documented use case. The technical problem is not just excess entitlements, but accumulated blast radius: a large population can reach systems they rarely or never use, increasing the impact of compromise or misuse. Usage data is the clearest signal of whether access is actually needed. Without it, entitlement models become assumption driven rather than evidence driven. Continuous monitoring narrows the gap between granted access and actual use, which is where identity risk tends to accumulate.

Practical implication: compare entitlement grants to real usage and remove access that cannot be justified by observed need.

Why least privilege needs time-bound access and continuous recalibration

Least privilege is not a static policy statement. It requires access scope to change as tasks, roles, and risk change, and the article points to just-in-time and time-bound access as practical ways to do that. JIT access reduces standing privilege by granting access only after request, while time-bound access ensures the privilege expires automatically after the work is done. That matters because identity risk is dynamic, not event based. Continuous calibration is the mechanism that keeps privilege aligned to current need instead of historical assumption. In other words, the control plane has to move closer to the moment of use.

Practical implication: use time-bound access for elevated permissions and continuously recalibrate entitlement scope against current business need.

NHI Mgmt Group analysis

Continuous identity management is a control-plane problem, not a review-cycle problem. Quarterly and yearly reviews were designed for compliance evidence, not for real-time privilege governance. That model fails when access state changes faster than certification cycles, because the programme is measuring yesterday's entitlement picture while the risk is happening today. The implication is that identity teams must treat access state as live security data, not audit residue.

Over-provisioning is the identity equivalent of unmanaged attack surface. Birthright access and role-based assumptions create broad entitlement sets that most users never exercise, which means the organisation is carrying more reachable privilege than it needs. That widens the practical blast radius of compromise and makes access review a blunt instrument. The conclusion is that usage, not title, should drive entitlement decisions.

Least privilege becomes operational only when access can expire automatically. Time-bound and just-in-time access convert privilege from a standing condition into a bounded one, which is far better aligned with how work is actually done. This does not replace governance, but it changes governance from periodic confirmation to continuous calibration. Practitioners should stop treating access as durable by default.

Continuous identity management: access governance that tracks entitlement state, usage, and expiry in near real time rather than waiting for periodic review. That concept captures the article's core shift: identity programmes need a live control plane, not an after-the-fact certification process. For practitioners, the practical question is whether privilege is being governed at issuance, use, and expiry or only at review.

Compliance remains necessary, but it is not sufficient for identity security. The article correctly separates regulatory minimums from security effectiveness, and that distinction matters across IAM, IGA, and PAM. A programme can satisfy review obligations while still leaving excessive, stale, or unnecessary access in place. The practitioner takeaway is to align compliance evidence with real access reduction outcomes, not to confuse the two.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.

What this signals

Continuous identity governance has become the practical answer to privilege drift. Access review cadences that once felt acceptable now leave too much time for unnecessary privilege to accumulate and too little time for the business to react. Programme owners should expect identity controls to move closer to issuance, usage, and expiry rather than sit only at the certification layer.

Continuous identity management also sharpens the boundary between compliance and security. A programme can satisfy review requirements and still carry excess access, which means governance teams need evidence of privilege reduction, not just review completion. That shift matters for human IAM, but it becomes even more important when non-human or delegated access expands the number of identities to manage.

Usage-based entitlement reduction is the clearest operational signal. If users rarely access what they are entitled to use, the organisation is carrying unnecessary identity risk, and that risk compounds between audits. Continuous monitoring turns that pattern into an actionable control signal instead of a periodic discovery.

For practitioners

• Audit for access based on usage, not title Compare actual system usage to the access users currently hold, then remove entitlements that are justified only by job title, team, or inherited role.
• Introduce time-bound access for elevated permissions Replace standing elevated access with request-based access that expires automatically when the task or approval window ends.
• Continuous monitor for over-provisioned privileges Deploy monitoring that flags unnecessary privileged access in near real time so remediation starts before the next review cycle.
• Document a continuous identity control strategy Define who owns entitlement review, what thresholds trigger action, and how remediation is tracked so identity security is managed as an ongoing control.

Key takeaways

• Identity programmes that rely on periodic reviews are blind to privilege drift between certification cycles, which is where much of the real exposure accumulates.
• Over-provisioning and birthright access expand the reachable attack surface, so usage evidence has to replace title-based assumptions.
• Just-in-time and time-bound access are the practical controls that convert least privilege from policy language into enforceable behaviour.

Key terms

• Continuous Identity Security: Continuous identity security is the practice of discovering, validating, and adjusting access as environments change, instead of relying on periodic reviews. It combines inventory, policy enforcement, misuse detection, and revocation so that access state follows the real operating environment rather than yesterday's approval.
• Over-provisioning: The condition where an identity has more access than it actually needs to do its work. In practice, this creates unnecessary blast radius, increases misuse potential, and makes access reviews look compliant even when the live environment is carrying excess privilege.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Birthright Access: The baseline set of entitlements that a user should receive by default because of role, department, or another stable attribute. It is a governance construct, not a blanket permission model. The control challenge is proving that the baseline stays current as jobs, applications, and ownership change.

What's in the full article

Opal Security's full article covers the operational detail this post intentionally leaves for the source:

• Examples of how organisations can measure access usage against entitlement scope
• Discussion of how continuous monitoring can be paired with remediation workflows
• Specific guidance on building a least privilege council or identity security council
• The article's own positioning on continuous monitoring versus traditional identity governance

👉 The full Opal Security article expands on continuous monitoring, least privilege, and accountability for identity governance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.