TL;DR: Organisations can strengthen cyber resilience by making identity the control plane, extending zero trust to third parties, adopting passwordless access, and using access analytics to reduce friction and risk during Cybersecurity Awareness Month, according to Imprivata. The underlying challenge is that security programmes still assume users will tolerate complexity, but control design only works when secure workflows are also the easiest workflows.
At a glance
What this is: This is an Imprivata analysis arguing that identity should be treated as the control plane so security controls remain usable enough to be followed.
Why it matters: It matters because IAM, PAM, and NHI programmes fail when policy creates friction that drives unsafe workarounds, especially across shared devices, vendor access, and frontline workflows.
Context
Identity as the control plane means access decisions are made consistently through identity policy rather than bolted on per system or device. In this model, the security problem is not simply whether controls exist, but whether people can actually use them in the flow of work.
Imprivata's article frames the core governance gap as a usability failure inside security design. When authentication, access reviews, and third-party controls are too cumbersome, users route around them, and the intended control plane stops governing real behaviour.
The article is therefore less about a single product choice than about operating model design. For IAM teams, the challenge is to make the secure path the easiest path across human access, shared endpoints, and external users.
Key questions
Q: How should security teams govern identity as a control plane?
A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate. That means combining IAM, PAM, and NHI lifecycle controls with continuous evaluation, machine-readable policy, and delegation tracking. If identity is only provisioned and not governed, the rest of the stack is protecting decisions that were never validated.
Q: Why do passwordless and MFA programmes fail when user experience is poor?
A: They fail because users respond to friction by delaying, sharing, bypassing, or working around controls, which weakens the programme's real coverage. Security only improves when the safer path is also the faster or simpler path for routine work. Adoption depends as much on workflow fit as on technical strength.
Q: What are the signs that identity controls are creating too much friction for legitimate users?
A: Common signs include rising application drop-off, longer call centre handle times, more abandoned transactions, and more customers failing at routine authentication steps. If fraud controls are too rigid, support volume often rises while completion rates fall. Teams should watch both security outcomes and customer journey metrics to see whether controls are balanced correctly.
A: Bring non-employee users into the same access governance model, with least privilege, continuous verification, and monitoring that matches the risk of their access. Third-party users are part of the control plane whether the organisation plans for them or not. Separate governance for external access usually becomes a breach opportunity.
Technical breakdown
Identity as the control plane
A control plane is the policy layer that determines how access is issued, verified, and adjusted across systems. When identity becomes that layer, login, device access, and application entitlement are governed by the same decisions instead of inconsistent local rules. The technical value is consistency, but the operational risk is drift if identity policy is not enforced across every workflow, endpoint, and third-party access path. This is why identity architecture must be designed as an access governance layer, not just an authentication layer.
Practical implication: Map each major access path to a single governing identity policy and identify where local exceptions bypass it.
Passwordless authentication and MFA in practical terms
Passwordless authentication reduces repeated secret entry by replacing memorised passwords with stronger authenticators such as passkeys, biometrics, badges, or device-bound methods. MFA still matters because it adds another verification factor, but the article's point is that security controls lose value if they are too slow or cumbersome for frontline users. The architectural question is not whether to add more checks, but whether those checks preserve workflow continuity while resisting phishing and credential reuse.
Practical implication: Prioritise passwordless and MFA designs that remove friction from high-frequency workflows without lowering assurance.
Access analytics and identity threat detection
Access analytics turns identity telemetry into an operational signal by measuring login duration, failures, device usage, and unusual access patterns. ITDR extends that by detecting behaviour that deviates from the configured norm and then adjusting friction or response based on risk. The mechanism is important because security teams often see only violations, not the day-to-day cost of controls. Identity analytics exposes where policy design is driving user workarounds, weak adoption, or avoidable exposure.
Practical implication: Use login, failure, and device-usage data to find where identity controls are creating avoidable friction or blind spots.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance fails when secure workflows are not the easiest workflows: That is the central control-plane lesson in this article. Security policy can be technically correct and still lose operational authority if users are pushed toward workarounds. For IAM and NHI programmes, usability is not a comfort feature, it is part of enforcement.
Identity as the control plane is really a consistency problem: the same access logic must govern users, devices, shared workstations, and vendor access. When one access path is governed differently from another, the organisation creates a shadow exception layer that undermines both assurance and auditability. The practitioner implication is to treat inconsistent access paths as governance defects, not user behaviour problems.
Passwordless adoption is a governance decision, not just an authentication upgrade: the value is not only fewer passwords but fewer points where users can be trapped by friction and unsafe habits. That makes adoption dependent on workflow fit, device compatibility, and user trust. Teams that ignore those operational constraints usually get partial deployment and uneven control coverage.
Third-party access becomes a control-plane test: if contractors and vendors sit outside the same identity policy model as employees, the programme is not really control-plane driven. The article correctly points to external access as one of the most exploited breach vectors. The lesson is that identity governance must extend uniformly beyond the workforce boundary.
Named concept: secure workflow parity: the article describes a model in which the secure path and the easy path are the same path. That is the practical condition under which identity controls become durable rather than bypassed. Practitioners should use secure workflow parity as a design test for authentication, access review, and shared-device programmes.
What this signals
Secure workflow parity: identity programmes become durable only when the approved path is also the path people prefer. If secure access feels slower than the workaround, control drift is already under way.
Access analytics is most valuable when it shows where policy design is producing login delays, repeated failures, or device-sharing behaviour that the security programme never intended.
Third-party access should be treated as part of the same identity plane as employees, because exceptions at the boundary usually become the highest-risk access paths.
For practitioners
- Define the identity control plane Map the core access policy layer across logins, devices, applications, and third-party access so the same rules govern each path.
- Reduce friction in high-use workflows Identify the login and access journeys that frontline teams repeat most often, then redesign them so secure access does not slow routine work.
- Extend zero trust to external users Apply the same verification and least-privilege expectations to vendors and contractors that you use for employees, including ongoing monitoring.
- Use access telemetry as governance evidence Track login duration, failures, and device utilisation to find where controls are driving workarounds or hidden productivity loss.
- Test secure workflow parity before rollout Validate that the secure workflow is also the easy workflow before broad deployment, especially for shared devices and passwordless access.
Key takeaways
- Identity control only works at scale when the secure path is also usable enough to become the default path.
- Passwordless access, MFA, access reviews, and third-party governance all depend on workflow design as much as policy design.
- Access telemetry helps security teams see where friction, workarounds, and inconsistent access paths are undermining the control plane.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on consistent access policy across users, devices, and vendors. |
| DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | Access analytics and ITDR depend on monitoring identity behaviour for anomalies. | |
| Recommendation — Apply PR.AA-05 to align entitlements with current roles and remove inconsistent access paths. Use DE.CM-01 to monitor identity activity for unusual login, failure, and access patterns. | ||
| NIST Zero Trust (SP 800-207) | Continuous Verification — Continuous Verification | The article explicitly promotes zero trust with ongoing verification for employees and third parties. |
| Recommendation — Apply continuous verification so access decisions stay conditional on current trust signals. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Passwordless and MFA adoption depend on authenticator lifecycle and management controls. |
| Recommendation — Use IA-5 to manage authenticators that replace passwords and reduce credential risk. | ||
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | The third-party and device-access discussion overlaps with human behaviour around non-human access paths. |
| Recommendation — Review whether people are reusing or bypassing non-human access paths in ways that weaken governance. | ||
Key terms
- Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
- Secure Workflow Parity: Secure workflow parity is the condition where the approved access path is also the easiest path for users to follow. In identity programmes, it is the difference between durable control and routine bypass behaviour, especially in shared-device, frontline, and third-party scenarios.
- Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org