Identity governance is now a board-level cyber control in 2025

At a glance

What this is: Omada Identity’s 2025 report shows identity security has moved into the cyber strategy conversation, but many organisations still face manual IGA processes, cost pressure, and cloud-era governance gaps.

Why it matters: For IAM, IGA, and security teams, this means identity governance is no longer a back-office workflow problem but a board-relevant control plane for access, compliance, and risk reduction.

By the numbers:

• 95% of leaders now treat identity security as a critical component of their overall cybersecurity strategy.
• More than 86% of leaders express concern about the risks of identity-based threats.
• More than 500 IT and business executives took part in the survey behind the report.

Context

Identity governance is the set of processes that decide who gets access, who keeps it, and when it is removed. In Omada Identity’s 2025 report, those decisions are now being treated as part of core cyber defence rather than a separate administration task.

The governance gap is practical, not theoretical. Manual workflows, restrictive total cost of ownership, and slow adoption of cloud-based IGA are still limiting how quickly organisations can enforce access controls, satisfy audits, and respond to identity risk.

The article’s message is that digital transformation has changed the risk profile faster than many identity programmes have changed their operating model. That makes identity governance a board-level control issue, not simply an IAM tooling discussion.

Key questions

Q: What breaks when identity governance still relies on manual approvals and rule maintenance at scale?

A: Manual governance increases error, slows access decisions, and raises the chance that users receive inappropriate or delayed access. It also makes role design, certification, and revocation harder to keep current. As environments grow, teams lose operational consistency and spend more time resolving exceptions instead of preventing risky access patterns.

Q: Why do outdated identity governance processes increase cyber risk in cloud environments?

A: Outdated identity governance usually leaves access decisions too slow, too manual, and too broad for cloud operations. That creates standing privileges, stale entitlements, and weak review cycles that attackers can exploit. Modern governance reduces risk by tying access to business need, automating lifecycle controls, and keeping entitlement data current across systems.

Q: How do security teams know if business-driven IGA is working?

A: Look for falling revocation latency, fewer orphaned accounts, fewer unused entitlements, and faster completion of access changes after joins, moves, and exits. If review outcomes improve but stale access still persists between cycles, the programme is only documenting risk instead of reducing it.

Q: What is the difference between access management and identity governance?

A: Access management controls how access is granted and used at runtime, while identity governance decides whether that access should continue to exist. The two functions become much stronger when connected, because usage data can inform governance actions. Without that connection, teams often review stale entitlements without knowing whether they were ever used.

Technical breakdown

Why identity governance becomes a cyber control

Identity governance and administration sits at the point where access decisions become enforceable policy. When organisations tie identity governance to cyber strategy, they are acknowledging that joiner, mover, leaver workflows, access certification, and privileged access reviews directly affect breach exposure and compliance outcomes. In hybrid estates, the control problem is not only whether access exists, but whether it can be reviewed and removed fast enough to matter. That is why IGA increasingly functions as a security control plane, not just an administration layer.

Practical implication: Treat IGA as a control surface for access risk, audit evidence, and removal of stale privileges.

Why manual IGA processes keep failing

Manual identity workflows create delay between policy intent and enforcement. Each approval chain, spreadsheet review, and exception process increases the time window in which overprovisioned access, role creep, or orphaned entitlements can persist. In cloud and SaaS-heavy environments, those delays matter because identities are changing continuously while governance often still runs on batch cadence. The article’s point is not that automation is optional, but that manual effort is now a structural constraint on governance quality.

Practical implication: Reduce review lag by automating certification, access recertification, and leaver handling where possible.

How cloud adoption changes the IGA operating model

Cloud-based IGA matters because hybrid environments multiply the number of connected systems that must be governed consistently. SaaS adoption, federated access, and distributed business ownership all make entitlement inventories harder to maintain and review. Modern IGA therefore needs better lifecycle orchestration, better visibility into entitlements, and stronger policy enforcement across systems that are not centrally administered. Cost pressure compounds the issue, because organisations often delay modernisation even after recognising the governance gap.

Practical implication: Map your current access governance coverage across cloud, SaaS, and legacy systems before deciding where modernisation is most urgent.

NHI Mgmt Group analysis

Identity governance is now a board-level cyber control, not an administrative back office function. The report shows that executives increasingly link identity security to overall cyber strategy because access decisions now shape breach risk, auditability, and operational resilience. That elevates identity governance from process efficiency to governance accountability. Practitioners should expect stronger scrutiny of how quickly access is approved, reviewed, and removed.

The real constraint is governance velocity, not governance intent. Organisations can recognise the need for modern IGA and still fail because manual processes and high total cost of ownership slow execution. That gap matters more in cloud and SaaS-heavy estates, where identities and entitlements change faster than periodic reviews can track. The practitioner conclusion is that a governance programme that cannot move at digital speed will not control digital risk.

Governance latency: access control that depends on slow review cycles no longer matches the pace of hybrid identity change. This is the clearest named concept in the article’s substance. Access decisions are only effective if they happen close enough to the change event to prevent accumulation of risk. For identity teams, the implication is to measure how much of the access estate still depends on delayed certification and exception handling.

Cost pressure is changing buying criteria, but it is not changing the control problem. The survey suggests organisations are looking for lower-friction, cloud-based, and more automated approaches because time-consuming manual processes remain a major pain point. That does not reduce the governance requirement. It raises the bar for solutions that can improve enforcement without making operating overhead the new blocker.

Identity governance now bridges human IAM, NHI governance, and autonomous access oversight. The same lifecycle logic that governs employee access also applies to service accounts, workload identities, and emerging agentic systems. The governance domain is converging even if the identities differ. Practitioners should design access review, offboarding, and policy enforcement to work across all three identity classes.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Governance latency: the operational delay between an access change and its certification or removal is now a measurable security risk. When identity estates span cloud and SaaS systems, review cycles that once looked acceptable can leave excessive access in place long enough to matter.

Identity programmes should be judged less by whether reviews exist and more by whether they keep pace with real change. That means focusing on revocation speed, exception volume, and how much of the estate still depends on manual intervention.

The same governance logic now applies across employee access, service accounts, workload identities, and emerging agent-driven access paths. Identity teams that keep those domains separate will struggle to see the full control gap.

For practitioners

• Audit governance latency across critical access workflows Measure how long it takes to approve, certify, or revoke access in the systems that matter most. Focus on where manual routing, exceptions, or ownership ambiguity create delays that weaken enforcement.
• Prioritise cloud and SaaS entitlements for automation Move recurring certification, leaver handling, and policy enforcement away from spreadsheet-driven reviews where entitlements change frequently. Start with applications that have the highest business exposure and the least tolerance for stale access.
• Reassess IGA total cost of ownership against control coverage Compare tooling spend with the coverage actually delivered across hybrid estates, including visibility, review cadence, and removal speed. High licence efficiency means little if governance actions still arrive too late.
• Extend governance scope beyond employee identities Make sure service accounts, workload identities, and emerging AI-enabled access paths are included in access review and offboarding design. If these identities are excluded, governance will only be partial even when human IAM looks mature.
• Align compliance reporting with live governance evidence Use reporting that shows who approved access, when reviews occurred, and how fast entitlements were removed. Compliance teams need evidence that reflects current control performance, not just policy intent.

Key takeaways

• Identity governance has moved into the cyber strategy layer because access decisions now influence breach risk, compliance, and operational resilience.
• The report points to a persistent execution gap, with manual processes, cost pressure, and cloud complexity slowing effective governance.
• Organisations need faster, more automated lifecycle control if they want identity governance to function as a live security control rather than a retrospective review process.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Governance Latency: Governance latency is the delay between a change in risk, relationship, or access need and the point at which the control model reflects that change. In API environments, high governance latency turns simple access management into a bottleneck and increases residual exposure.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Hybrid Identity Estate: A hybrid identity estate combines cloud and on-premises identity systems under one operational environment. For NHIs, this usually means certificates, service principals, and service accounts are distributed across tools and teams, which makes visibility and lifecycle enforcement harder unless controls are centralised.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.