TL;DR: Identity governance tools can only make accurate decisions when they see both access state and activity state, according to Hydden. Without raw activity data, dormant, active, and compromised accounts can look identical, which weakens PAM vaulting, IGA certification, and lifecycle decisions.
At a glance
What this is: This is a Hydden analysis arguing that identity platforms fail when activity data is missing, because access state without usage context cannot separate dormant, active, and compromised identities.
Why it matters: IAM, IGA, and PAM teams need activity context to make defensible access decisions, because lifecycle reviews and vaulting logic are materially weaker when they only see entitlements and not behaviour.
Context
Identity governance depends on more than a snapshot of who has access. Activity data is the missing layer that shows whether an identity is being used, whether its credentials have been exposed, and whether its current behaviour still matches its original entitlement model.
The problem matters across IAM, IGA, and PAM because each tool reasons from stateful records. When the dataset lacks login history, last access dates, or credential exposure signals, systems can treat very different accounts as equivalent and make the same decision about all of them.
Hydden's argument is that the control plane is not the only issue. The quality of the underlying identity dataset now determines whether lifecycle decisions, vaulting choices, and certification outcomes reflect real operational risk or just administrative history.
Key questions
Q: How should teams govern identity decisions when activity data is incomplete?
A: Treat incomplete activity data as a governance constraint, not just a reporting problem. If current use cannot be observed, certification and vaulting decisions should be flagged as low-confidence. Teams need to correlate entitlement state with runtime evidence before deciding whether an account is dormant, active, or risky.
Q: Why do PAM and IGA tools misclassify dormant accounts without activity data?
A: Because stateful records show what the account is entitled to do, not whether it has recently done it. Without runtime context, a dormant privileged account and a dormant low-risk account can appear equivalent, so the tools apply the same workflow to two very different risk profiles.
Q: What are the signs that an identity stack is relying on stale data?
A: Look for certification queues built only from access assignments, vaulting decisions that ignore recent use, and remediation outcomes that cannot distinguish inactive from exposed accounts. Those are symptoms that the stack is seeing configuration history but not current identity behaviour.
Q: How does activity data change lifecycle and access review decisions?
A: It turns lifecycle processes from snapshot reviews into evidence-based decisions. When activity is present, teams can prioritise accounts that are both entitled and recently active, rather than spending equal effort on all accounts that merely exist in the directory.
Technical breakdown
Stateful identity data versus activity data
Stateful identity data describes what an account is allowed to do at a point in time. Activity data describes what that account has actually done across systems, including logins, last-use timestamps, and credential exposure signals. The distinction matters because entitlement state is static while risk changes between reviews. An account can remain entitled, dormant, and compromised at the same time if the platform cannot see recent activity. Identity tools that rely only on state are therefore making decisions from configuration, not from evidence of use.
Practical implication: collect activity telemetry alongside entitlement data before making lifecycle or vaulting decisions.
Why PAM and IGA misclassify accounts without usage context
PAM and IGA often evaluate the same identity through different lenses, but both can fail when usage context is absent. A dormant privileged account with stale credentials may look identical to a dormant low-risk account if the system only sees access assignments. That creates false equivalence in certification queues and vaulting workflows. The technical issue is not just missing data, but missing correlation between stateful access records and runtime activity records from each source system.
Practical implication: correlate activity records with entitlements so privileged and low-risk dormant accounts do not receive the same treatment.
Correlated identity data as a decision layer
A data layer that normalizes and correlates activity across systems changes how identity tools behave without replacing them. Instead of asking only who has access, teams can ask whether the account is active, whether its credentials appear exposed, and whether its current behaviour matches its intended role. That shifts identity governance from periodic snapshot reviews to evidence-driven decisions. The architectural value lies in making activity a first-class input to existing tools rather than a separate manual investigation step.
Practical implication: feed normalized activity data into existing identity tools so reviews and remediations use current evidence.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Activity blindness creates identity false positives and false negatives at the same time: when tools can only see entitlement state, dormant and compromised accounts can be treated as equivalent. That is not a minor visibility issue. It means governance decisions are being made against administrative snapshots instead of operational reality, which weakens both assurance and risk reduction.
Identity blast radius is increasingly driven by what tools cannot observe: a privileged account that has not been used for months still looks legitimate until activity data reveals whether it is stale, exposed, or both. In practice, the absence of runtime evidence hides the difference between harmless inactivity and dangerous latent privilege. Practitioners should treat missing activity telemetry as a governance defect, not a reporting gap.
Activity data is the control input that PAM and IGA were implicitly assuming all along: the vendor's argument shows that lifecycle and certification processes were designed for a world where current use could be inferred from state. That assumption fails when access state and usage state diverge. The implication is that identity assurance now depends on correlating behaviour, not merely recording entitlements.
Continuous enrichment is becoming a prerequisite for defensible access decisions: point-in-time certification cannot compensate for incomplete source data. If the platform cannot continuously collect and normalize activity across applications, the resulting decisions will remain partial regardless of how mature the workflow looks. Teams should judge identity tooling by whether it can see current use, not by whether it can process an access list.
Governance teams need a stronger definition of identity truth: the relevant question is no longer only whether an account exists or is approved, but whether the account is active, clean, and aligned with its current purpose. That is a broader standard than traditional IAM state management. Practitioners who keep treating access state as sufficient will keep certifying incomplete risk pictures.
From our research library:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- Read next: Service Account Security Guide
What this signals
Identity governance needs a data-layer upgrade: if access decisions are built on state alone, they will continue to miss the gap between entitlement and use. Teams should expect more false equivalence in certification and vaulting until activity data becomes part of the standard identity feed.
Current use is now part of identity truth: practitioners cannot treat activity freshness as optional metadata when the same account may be dormant, exposed, or in active use depending on the source system. The governance question is not just who has access, but what that identity has done recently enough to trust the record.
A stronger operational model is emerging: collect activity at the source, normalize it, and make it available to the tools already making PAM and IGA decisions. That approach does not replace the stack; it gives the stack the evidence it has been missing.
For practitioners
- Define activity data as a required input Add raw activity signals such as login history, last access date, and credential exposure context to the identity dataset before running certification or vaulting workflows.
- Correlate stateful and runtime records Join entitlement records to current usage data so dormant privileged accounts do not look identical to dormant low-risk accounts in review queues.
- Re-score privileged accounts with current evidence Use current activity and exposure context to separate accounts that are merely inactive from those that are inactive and risky.
- Make activity freshness part of governance Set operating thresholds for how recent activity data must be before it can support certification, remediation, or access approval decisions.
Key takeaways
- Identity tools become far less reliable when they cannot see actual account activity, because state alone does not show whether an identity is dormant, active, or exposed.
- The core risk is false equivalence: privileged and low-risk accounts can look the same in certification and vaulting workflows when runtime context is missing.
- The practical response is to make activity data a first-class governance input so access reviews and remediation decisions use current evidence instead of stale snapshots.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Missing activity data causes privileged accounts to be treated as equivalent to lower-risk accounts. |
| NHI-07 — Long-Lived Secrets | The article ties exposure risk to credential status and whether those credentials have been used recently. | |
| Recommendation — Use NHI-05 to separate privileged accounts from routine accounts before certification or vaulting decisions. Apply NHI-07 to flag stale credentials whose age and activity do not match their risk posture. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about the quality of access decisions built from entitlement data and runtime evidence. |
| Recommendation — Correlate entitlements with activity evidence before granting or recertifying access permissions. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account management decisions depend on knowing whether identities are active, dormant, or compromised. |
| Recommendation — Audit account records with current usage data so inactive but risky identities do not remain unchallenged. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential status and exposure context are central to the article's account-risk argument. |
| Recommendation — Tie authenticator management to current activity evidence before approving continued access. | ||
Key terms
- Activity Data: Activity data is the operational record of what an identity has actually done across systems, such as logins, access events, and credential status. Unlike entitlement snapshots, it shows whether an account is active, dormant, or behaving inconsistently with its assigned role.
- Stateful Identity Data: Stateful identity data is a point-in-time view of accounts, groups, permissions, and policies. It is useful for inventory and baseline checks, but it does not show whether those identities are being used, abused, or exposed between review cycles.
- Identity Dataset Correlation: Identity dataset correlation is the process of joining activity records with access and entitlement records so tools can evaluate current use alongside approved permissions. It reduces false equivalence in IAM, IGA, and PAM by making runtime evidence part of the governance decision instead of a separate investigation.
- Identity Freshness: Identity freshness is the degree to which the governance system reflects the live state of accounts, groups, entitlements, and credentials. It is not just a performance metric. In practice, freshness determines whether access reviews, approvals, and offboarding actions are based on reality or on a delayed snapshot.
Deepen your knowledge
NHI governance, identity lifecycle, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org