TL;DR: Identity governance that stops at audit evidence can still miss active abuse, because quarterly reviews, manual workflows, and disconnected controls do not see real-time access risk, according to RSA Security. Compliance remains necessary, but risk-aware governance is the operating model that closes the gap between certification and security.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on RSA Security's blog post: Identity governance should move from compliance-first certification to risk-aware decisioning that uses context and continuous visibility.
Why it matters: For IAM, IGA, PAM, and NHI teams, the message is that periodic reviews alone do not shrink attack surface if governance cannot react to real-time risk signals.
Context
Identity governance is often treated as evidence collection, but that model breaks when access changes faster than review cycles. The core problem is not whether a review happened, but whether the programme can detect risky access while it is still exploitable.
RSA Security frames identity security posture management as a response to that gap. The article argues that governance must use continuous visibility, contextual signals, and risk-based prioritisation if it is meant to reduce exposure rather than just satisfy auditors.
Key questions
Q: What breaks when governance relies only on quarterly access reviews?
A: Quarterly reviews miss the day-to-day drift that accumulates between certification cycles. By the time the review happens, the access graph may already have changed, so the programme validates yesterday’s state rather than today’s risk. That makes certification useful for assurance, but weak as a primary control.
Q: Why do compliance-focused governance programmes still miss identity-based attacks?
A: Because compliance tells you that controls existed, not that they were timely enough to stop abuse. If governance is manual, disconnected from security signals, and limited to periodic certification, it cannot respond to changing user behaviour or sudden privilege misuse. The result is a programme that satisfies auditors while leaving active exposure in place.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review. If teams still spend days reconstructing access state, governance is not operating continuously. Effective programmes can show current MFA coverage, role scope, and credential age on demand.
Q: How should financial institutions use identity governance for DORA and NIS2 compliance?
A: They should use identity governance as the evidence layer for access approval, review, and removal. The practical goal is to show that every entitlement has an owner, a business reason, and a lifecycle path. That makes compliance traceable and reduces the chance that stale access becomes an audit finding or operational weakness.
Technical breakdown
Why quarterly access reviews miss active risk
Periodic certification assumes access remains stable long enough for a reviewer to see it, understand it, and act on it. In practice, role changes, privileged access, toxic combinations, and unusual behaviour can emerge and be abused between review cycles. When governance runs on manual workflows and disconnected evidence collection, it becomes a lagging control that records exposure after the fact. The issue is not review frequency alone. It is the mismatch between the tempo of identity risk and the tempo of governance.
Practical implication: move governance decisions closer to the moment access is granted or changed.
How ISPM changes the governance data model
Identity security posture management is a governance approach that starts with live visibility across cloud apps, infrastructure, and legacy systems, then adds risk context to access decisions. That means the programme is no longer limited to entitlement inventories and certification queues. It can prioritise reviews by user risk profile, surface separation-of-duties violations, and incorporate signals such as location, device, and time of access. In effect, it turns identity governance from a periodic record-keeping exercise into a continuous control plane for access risk.
Practical implication: feed governance with live identity, device, and behavioural context rather than relying only on static entitlement data.
Why compliance and security are not the same control objective
DORA, NIS2, and GDPR raise the bar for governance, but their intent is broader than producing audit artefacts. They expect resilience, risk mitigation, and operational continuity, which means identity governance must prove that it can reduce exposure and not just document it. A programme can pass a review and still leave high-risk access in place long enough to matter. That is why compliance evidence and security outcomes must be measured separately, even when the same workflow supports both.
Practical implication: test governance controls for risk reduction, not only for audit completion.
Threat narrative
Attacker objective: The objective is to retain exploitable access long enough to steal data or operate inside the environment before governance catches up.
- Entry begins when an employee changes roles or otherwise gains access to a critical system that was not yet fully governed by live risk controls.
- Escalation occurs when that access is used to reach sensitive data while governance remains dependent on quarterly review cadence rather than contextual monitoring.
- Impact follows when exfiltration or other abuse persists undetected for months because the control only certifies access after the exposure window has already opened.
Breaches seen in the wild
- Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Compliance-first governance leaves a security gap by design: A certification process can prove that access was reviewed, but it cannot prove that access was safe when it mattered. RSA Security's point is that audit evidence and exposure reduction are not the same outcome, and treating them as equivalent creates blind spots in modern identity programmes. Practitioners should separate proof of review from proof of risk control.
Identity security posture management is the missing operating layer: The article's strongest idea is that governance needs live context, not just entitlement snapshots. Behavioural signals, user risk, and toxic combinations make access decisions more current than manual certification ever can. That shifts identity governance from a records function to an active security control, which is where it belongs.
Risk-aware governance changes the meaning of least privilege: Least privilege is not just about assigning fewer entitlements at provisioning time. It is about continuously validating whether the access that exists still matches current role, device, location, and business need. If those signals are not part of governance, least privilege becomes a static label rather than an enforced condition.
DORA and NIS2 are pushing identity governance toward operational resilience: These regimes are not satisfied by checkbox compliance if the access model still allows risky entitlements to persist through long review cycles. That is why modern governance has to be measured by how quickly it can detect, prioritise, and revoke dangerous access. The practical test is whether governance improves resilience, not just attestation readiness.
Continuous governance is now the default expectation for identity risk management: The article points toward a market shift in which identity governance is judged by its security utility, not by its documentation volume. That direction affects human IAM, NHI governance, and hybrid environments alike because the control problem is the same: access changes faster than periodic review can see it. Practitioners should treat continuous visibility as the baseline, not the enhancement.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Continuous governance is becoming the practical baseline: Access reviews that depend on quarterly cadences cannot keep pace with identity risk that changes between business events. The programme question is no longer whether reviews exist, but whether they can detect and remove dangerous access before it is abused.
Identity governance needs to absorb live context: Location, device, and time of access are now governance inputs, not just monitoring signals. When those signals are absent, certification queues can only confirm history, not current risk.
Risk lens: Identity governance is increasingly judged by whether it reduces exposure, not whether it produces evidence. That matters across human IAM, NHI oversight, and hybrid environments because the underlying problem is the same: static review cycles cannot govern dynamic access.
For practitioners
- Prioritise access reviews by risk signal Move away from flat quarterly certification queues and rank reviews by user risk, sensitive system access, and anomalous context.
- Add behavioural context to governance decisions Use location, device, and time of access as governance inputs so reviewers see whether access is ordinary or suspicious.
- Map toxic combinations before certification cycles Identify separation-of-duties conflicts and privileged access combinations continuously, not after evidence has already been packaged for audit.
- Measure governance by risk reduction Track whether high-risk access is revoked faster, not only whether reviews are completed on schedule or exported for auditors.
- Align governance workflows with resilience objectives Connect identity governance outcomes to operational continuity, incident prevention, and risk management so compliance does not become the only success metric.
Key takeaways
- Compliance evidence alone does not prevent identity-based abuse when access reviews are periodic and manual.
- The article's core example is a role change followed by data exfiltration that may remain undetected for months.
- Continuous visibility, contextual signals, and risk-based prioritisation are the controls that separate security outcomes from audit outputs.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The article centers identity governance as a risk-management function rather than compliance only. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on access review, entitlement context, and privilege control. | |
| Recommendation — Align governance metrics to risk reduction, not just certification completion. Review entitlements continuously and revoke high-risk access based on current context. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account review, access changes, and privilege lifecycle are the article's core operational concerns. |
| Recommendation — Strengthen account governance by tying reviews to role changes and risk signals. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The article addresses how access control must move beyond periodic compliance checks. |
| Recommendation — Update access control rules so governance reflects live risk instead of static evidence. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article argues for continuously enforcing least privilege rather than certifying it after the fact. |
| Recommendation — Apply least privilege continuously, not only during scheduled recertification. | ||
Key terms
- Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.
- Risk-Based Identity Governance: Risk-based identity governance is the practice of assigning different levels of scrutiny to access based on the sensitivity of the system, privilege level, and business impact. It uses policy and automation to focus review effort where misuse would cause the most damage or compliance exposure.
- Toxic Risk Combinations: Toxic risk combinations are unsafe interactions between datasets, access permissions, and AI workflows that only become problematic when combined. Individually they may appear harmless, but together they can expose sensitive information, enable re-identification, or create unintended inferences that traditional controls may miss.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org