ISPM and ITDR exposed the limits of fragmented identity governance

At a glance

What this is: This analysis says ISPM and ITDR were directionally correct, but fragmented identity ownership and incomplete inventories stopped them from fixing the underlying governance problem.

Why it matters: IAM, PAM, IGA, cloud, and SOC teams need a shared identity baseline before posture and detection layers can produce reliable action across NHI and human estates.

Context

ISPM and ITDR are identity security disciplines that depend on trustworthy data about accounts, entitlements, and authentication behaviour. When an enterprise cannot reconcile AD, cloud, SaaS, service accounts, and privileged access into one live estate view, both posture scoring and detection logic start from a weak foundation.

The governance gap is not that these capabilities are useless. The gap is that they were often layered onto fragmented identity operations, where ownership sat in separate teams and no one was accountable for the full picture. In that environment, analytics can surface issues, but they cannot create the inventory required to resolve them cleanly.

Hydden's analysis frames this as a sequencing problem, not a tooling problem. The industry tendency was to add posture and threat detection before the identity data layer was reliable, which is why many organisations ended up with better dashboards instead of better control.

Key questions

Q: What breaks when identity tools are split across visibility, posture, and detection?

A: The response chain breaks. Teams get fragmented signals, duplicate tickets, and delayed containment because each tool sees only part of the identity story. Attackers benefit from that seam, especially when lateral movement or privilege escalation happens across systems that do not share a common identity context.

Q: Why do posture findings often turn into backlog instead of remediation?

A: Because the tool surfaces issues across multiple domains, but the authority to fix them remains split across directory, cloud, SaaS, and application teams. Without named ownership and a clear fix path, findings move into governance meetings and then into change queues, where they age instead of closing.

Q: How do security teams decide whether ITDR is working?

A: ITDR is working when responders can move from alert to containment without a long investigative detour. Look for shorter triage times, fewer unresolved identity alerts, and better visibility into who owns each credential or account. If the team still needs multiple tools to explain one identity event, the programme is not yet mature.

Q: Should organisations prioritise identity inventory before posture and detection?

A: Yes. A continuously reconciled identity inventory is the control that makes posture scoring and behavioural detection trustworthy. If the inventory is incomplete, both categories can still be useful, but they will produce partial and sometimes misleading outputs that are hard to operationalise at scale.

Technical breakdown

Why fragmented identity inventories break posture and detection

ISPM depends on a current inventory of identities, entitlements, and misconfigurations. ITDR depends on the same estate view plus behavioural context, so it can tell normal access from suspicious access. In large enterprises, identity data is often split across AD, cloud consoles, SaaS admin panels, helpdesk workflows, and local automation accounts. Each source is partially correct, but none is complete. That means posture findings and detections are both bounded by the same blind spots. The technical failure is not in the analytics layer alone. It is in the absence of a continuously reconciled identity graph that can serve as ground truth across systems.Practical implication: Treat identity inventory quality as the prerequisite control, not the downstream reporting layer.

Practical implication: Treat identity inventory quality as the prerequisite control, not the downstream reporting layer.

Why ownership boundaries turn findings into backlog

Identity posture tools can expose stale accounts, dormant admin rights, orphaned service accounts, and excessive OAuth grants, but they do not own remediation authority. In most enterprises, each finding lands with a different team: AD, cloud, SaaS, or application admins. ITDR has a similar split between identity engineering and SOC operations. That division matters because the control that surfaced the issue is not the control that can fix it. The result is governance theatre: findings are acknowledged, prioritised, and delayed through change windows or service backlogs. Technically, the tool works. Operationally, the control loop is broken because ownership and fix paths do not align.Practical implication: Map each finding to a named remediation owner before the platform is deployed.

Practical implication: Map each finding to a named remediation owner before the platform is deployed.

Why incomplete baselines make identity detections less trustworthy

ITDR needs a behavioural baseline for each identity, but unknown or uncatalogued accounts never get one. That creates a denominator problem. Short-lived service principals, direct cloud roles, local admin grants, and shadow SaaS credentials can all sit outside the monitoring perimeter. When those identities are missing, anomaly detection can only score the subset it sees, which distorts risk ranking and hides the most exposed credentials. The more incomplete the inventory, the more likely the platform is to miss the identity path an attacker will choose. This is why visibility gaps are not just an operational nuisance. They directly reduce detection fidelity.Practical implication: Baseline detection coverage against the full identity estate, not only against the accounts already integrated.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity posture and identity threat detection fail when the inventory layer is not trustworthy: ISPM and ITDR were built to expose misconfiguration and suspicious authentication behaviour, but both depend on the same upstream truth about what identities exist. When that truth is fragmented across AD, cloud, SaaS, and service accounts, the tools can only analyse partial reality. The practical consequence is not simply lower visibility. It is a governance model that starts reporting on the wrong denominator and then treats those outputs as operational fact.

The governance bottleneck is ownership, not discovery: A posture engine can find the stale account or over-privileged service principal, but it cannot force the AD team, cloud team, or SaaS owner to act in a coordinated way. That is why these categories so often became dashboards instead of control systems. The operating model, not the detector, determines whether findings become remediation or just another meeting.

Ground truth is the real control plane for identity security: The article makes a strong case that continuous identity visibility should precede posture scoring and behavioural detection. Once the estate view is incomplete, every downstream decision, from access review to SOC triage, inherits the same error. The discipline needs a single authoritative identity map before analytics can be trusted as anything more than educated guesswork.

Fragmented identity governance creates a denominator problem that the market keeps underestimating: Most enterprises still calculate coverage, risk, and anomaly rates from disconnected snapshots that drift as soon as they are exported. That is why more sophisticated analytics can produce more sophisticated wrong answers. Practitioners should judge identity security maturity by the quality of the underlying estate data, not by the number of findings a platform can generate.

Identity security will keep moving toward lifecycle governance and unified visibility, not isolated point detections: The long-term answer is not a better posture dashboard in isolation. It is a governance model that can track creation, privilege, use, and removal across the whole identity estate. Until that is in place, posture and detection will remain dependent on incomplete maps, and incomplete maps are still dangerous.

What this signals

Ground truth is the control plane: Identity programmes that treat posture and detection as the starting point usually end up measuring incomplete data faster. The better sequencing is to establish a continuously reconciled identity estate first, then let analytics consume that baseline.

Fragmentation creates a denominator problem: When coverage is calculated from disconnected exports, the numbers can look precise while still missing cloud roles, service principals, and shadow admin paths. That is why programme maturity should be judged by estate completeness, not by dashboard volume.

For practitioners

• Define a single identity estate inventory Consolidate AD, cloud, SaaS, privileged accounts, and service principals into one continuously reconciled view before relying on posture or detection outputs.
• Assign remediation owners by identity domain Map every posture finding to the team that can actually change it, such as directory, cloud, SaaS, or application owners, before governance review starts.
• Measure detection coverage against unknown accounts Test whether behavioural baselines exist for every privileged identity, including short-lived automation accounts and direct cloud roles, not only for integrated systems.
• Reorder the programme sequence Build the identity data layer first, then add posture scoring and threat detection so analytics consume reliable ground truth instead of fragmented exports.

Key takeaways

• ISPM and ITDR were useful responses to real identity risk, but their effectiveness depended on a complete identity inventory that most enterprises did not have.
• The main failure was not analytic weakness alone. It was fragmented ownership, incomplete data, and remediation paths that split across multiple teams.
• Identity security programmes need authoritative estate visibility before posture scoring and behavioural detection can be trusted as operational controls.

Key terms

• Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.
• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Identity Inventory: Identity inventory is the process of discovering and recording every identity that can access systems or data. For NHIs, it includes owner, purpose, privilege scope, lifecycle status, and where the credential is used. Without inventory, governance, audit evidence, and incident response all become partial and unreliable.
• Denominator Problem: The denominator problem is the distortion that occurs when metrics are calculated from incomplete identity data. In identity security, it means coverage, risk, and anomaly scores can look precise while still excluding large parts of the real estate, which makes the control outcome unreliable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.