DORA exposes the identity visibility gap in financial resilience

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Veza's blog post: Under DORA, financial institutions need granular identity and authorization visibility across human, third-party, NHI, and AI agent access.

Why it matters: It matters because resilience, incident response, and third-party risk programmes cannot meet DORA expectations if teams cannot reliably map entitlement scope across all identity types.

Context

DORA turns operational resilience into a regulated requirement for financial institutions, not just an internal security objective. In practice, that means teams must prove they can understand and manage ICT-related identity access before disruption, incident response, and recovery become test cases.

The gap in this article is not authentication alone. It is authorization visibility across users, third-party vendors, service accounts, non-human identities, and AI agent identities, where entitlement sprawl creates hidden risk beneath familiar IAM and PAM layers.

That makes identity inventory and permission mapping part of resilience engineering. If teams cannot confidently answer who has access to what and what those identities can do, the control model is too shallow for DORA-driven governance.

Key questions

Q: What breaks when teams only track identity accounts instead of effective permissions for DORA?

A: They lose the ability to prove who can actually perform regulated actions, which weakens incident response, recovery, and third-party risk governance. A directory can show that an account exists, but it cannot by itself prove whether that identity can move data, change controls, or trigger critical workflows. DORA programmes need entitlement-level visibility, not just account inventory.

Q: Why do third-party and non-human identities increase resilience risk?

A: Third-party and non-human identities often carry legitimate trust but limited lifecycle control, which makes them ideal pivot points once an attacker gets a foothold. If those identities are over-scoped, poorly monitored, or left active after use, they can enable lateral movement and expose systems that were never meant to be broadly reachable.

Q: How should financial institutions measure whether identity visibility is actually supporting resilience?

A: They should test whether they can answer who has access to what and what actions each identity can perform across critical systems, vendors, and automation. If that answer takes multiple tools, manual correlation, or guesswork, the control is not mature enough to support resilience obligations. The signal is speed, completeness, and confidence in the entitlement map.

Q: How do AI agent identities change access governance compared with human users and service accounts?

A: AI agents can require task-specific access that is created, used, and retired differently from human or static machine accounts. That means conventional review cycles may miss the moment when privilege is actually exercised. Financial institutions need a governance model that treats agents as distinct identity subjects with runtime access patterns.

Technical breakdown

Why authorization visibility matters more than identity lists under DORA

Identity inventories tell you that accounts exist, but they do not tell you what those accounts can actually do. DORA-driven resilience depends on authorization detail, meaning the effective permissions behind each user, vendor, workload, or AI agent must be visible and explainable. Traditional IAM, IGA, and PAM tools often stop at role, group, or account status, which leaves toxic permissions hidden across nested entitlements and inherited access. In a financial environment, that gap weakens incident readiness because teams cannot quickly determine blast radius, approval scope, or recovery dependencies.

Practical implication: map actual entitlements, not just account ownership, before treating any resilience control as complete.

How third-party vendors and dormant accounts create hidden resilience debt

Third-party access is not risky only because it exists. It becomes operationally dangerous when access survives long after the business need changes or when dormant accounts remain attached to production privileges. Those identities can sit outside normal review cycles while still retaining sensitive actions across finance, infrastructure, or incident-response systems. Under DORA, that persistence matters because a resilience failure is often amplified by access that nobody actively owns, monitors, or can revoke with confidence. The governance problem is lifecycle drift, where access outlives accountability.

Practical implication: reconcile vendor, dormant, and orphaned access against current business need, not historic provisioning records.

Why AI agent identities complicate financial resilience controls

AI agent identities introduce a different governance problem because their access can be dynamic, task-based, and difficult to review through human-centric controls. A role model designed for people does not necessarily explain what an agent can invoke, chain, or trigger across systems. That creates a visibility problem for DORA programmes trying to prove control over changing operational pathways. The issue is not merely that AI is new. It is that the identity subject can make runtime decisions that blur the boundary between request, execution, and authorization.

Practical implication: extend access visibility models to agent identities before those agents participate in regulated workflows.

NHI Mgmt Group analysis

DORA is forcing identity security out of the IAM silo and into resilience governance. Financial institutions can no longer treat identity visibility as an admin function that supports joiner-mover-leaver hygiene. Once resilience is regulated, entitlement clarity becomes part of proving that critical services can withstand, contain, and recover from ICT disruption. The practical conclusion is that identity governance and operational resilience are now the same control conversation.

Granular authorization visibility is the missing control surface in many financial environments. Most programmes can enumerate users and roles, but not the effective actions those identities can perform across nested permissions, vendor access, and machine identities. That gap creates a false sense of control because account presence is mistaken for access understanding. The practical conclusion is that resilience reporting must be anchored in entitlement truth, not directory inventory.

Vendor access without current lifecycle ownership is a resilience liability, not just an offboarding issue. Third-party accounts, dormant accounts, and stale permissions accumulate into identity technical debt that becomes visible only during incident response or audit pressure. In a DORA context, that debt slows containment because nobody can quickly separate required access from historical access. The practical conclusion is that financial firms must treat access drift as resilience degradation.

AI agent identities expose a governance model built for stable, human-paced access decisions. Access review processes were designed for identities whose privileges persist long enough to be reviewed, challenged, and recertified. That assumption weakens when an identity can acquire and use permissions in a task-driven, runtime pattern that outpaces conventional certification cycles. The practical conclusion is that DORA programmes must rethink authorization visibility for non-human and agentic actors together.

Identity visibility gap: the real DORA failure mode is not missing authentication, but missing proof of effective access. The article’s central message is that operational resilience depends on seeing who can do what across every identity type, including NHI and AI agents. That is the condition financial institutions must be able to evidence under pressure. The practical conclusion is that resilience architecture should be built around effective privilege, not just account status.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Service Account Security Guide

What this signals

Identity visibility is becoming a resilience control: financial institutions should expect DORA programmes to pull IAM, IGA, PAM, and NHI governance into one operational view. When access can no longer be explained at entitlement level, resilience claims become difficult to defend under audit or incident pressure.

The next governance gap is not account creation, but account usefulness. Teams will need to determine whether dormant vendors, service accounts, and agent identities still hold effective privileges that matter during disruption, because stale access is where recovery friction often begins.

For practitioners

• Inventory effective privileges across all identity types Build a single view that maps users, third parties, service accounts, tokens, and AI agent identities to the actions they can actually perform in production systems.
• Separate dormant access from active business need Review dormant, orphaned, and vendor-held access for current operational necessity, then remove permissions that survive only because no owner has challenged them.
• Extend resilience testing to authorization paths Test whether incident response and recovery teams can identify privileged paths quickly enough to contain disruption when access spans nested roles and external identities.
• Include AI agent identities in governance scope Treat agent identities as governed subjects in access reviews, escalation paths, and incident playbooks so their runtime permissions are visible before they affect regulated processes.

Key takeaways

• DORA pushes financial institutions to prove more than identity inventory. They need visibility into effective permissions across people, vendors, machines, and AI agents.
• The article highlights a structural gap between traditional IAM outputs and the entitlement detail required for resilience, especially where access drifts beyond active ownership.
• Financial teams should treat authorization visibility as part of operational resilience evidence, not as a separate IAM reporting exercise.

Key terms

• Effective Permissions: Effective permissions are the access an identity can actually use after role inheritance, scope, and policy are applied. In Azure AI environments, they often matter more than the assigned role name because inherited rights can widen access to data, logs, and secret stores.
• Security Technical Debt: Security technical debt is the accumulation of unresolved security issues created by fast delivery, weak controls or repeated exceptions. In IaC environments, one bad template or policy gap can be multiplied across many deployments, making the debt both visible and systemic.
• Access Visibility: Access visibility is the ability to see, in one place, which identities can reach which data, applications, and services. For IAM and data security teams, it is the difference between reviewing isolated permissions and understanding real blast radius across environments.
• Resilient Governance: Resilient governance is the ability of a control programme to keep working as technology, business processes, and regulations change. It is not just evidence that controls existed once. It is proof that policies, ownership, and enforcement remain effective under operational pressure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.