IT risk assessment for identity security: where current models fail

At a glance

What this is: This is an analysis of IT risk assessment that argues current models fail when asset discovery and access visibility are incomplete, especially across human and non-human identity paths.

Why it matters: It matters because IAM, IGA and NHI programmes cannot prioritise risk accurately if the underlying inventory, access scope and review inputs are incomplete.

Context

IT risk assessment is the process of identifying threats, vulnerabilities, likelihood and impact so an organisation can prioritise what to fix first. In identity security, that process only works when the asset and access picture is complete enough to reflect how people, applications and service access actually operate.

Zluri’s article uses that familiar risk model to show where it breaks in practice: discovery gaps, incomplete inventories and weak visibility into who can reach sensitive systems. That is an IAM and NHI governance problem as much as a general IT security problem, because the model is only as accurate as the identities and access paths it can see.

The article is typical of current risk guidance in one important respect. It assumes assessment quality improves mainly through better scoring discipline, when the deeper issue is whether the organisation can reliably enumerate its human and non-human access surface before it starts ranking risk.

Key questions

Q: How should security teams run IT risk assessments when they cannot see all applications and access paths?

A: Start by treating discovery quality as part of the assessment, not a separate pre-task. Build the risk register from a reconciled inventory of applications, identities, entitlements and owners, then label any gaps as uncertainty in the scoring itself. If you cannot enumerate the access surface, you cannot claim the risk model is complete.

Q: Why do incomplete inventories distort IT risk scores?

A: Because likelihood and impact depend on what the organisation can actually observe. When hidden SaaS, stale access or unmanaged service accounts sit outside the inventory, the model excludes part of the exposure and understates blast radius. The result is a score that looks precise but is built on partial evidence.

Q: What are the warning signs that IT risk assessment inputs are unreliable?

A: Look for inconsistent asset owners, unexplained access that survives role changes, shadow applications outside the approved stack and risk scores that change faster than the underlying inventory. Those signals usually mean the programme is scoring an incomplete estate rather than the real one.

Q: When should organisations prioritise discovery over access reviews?

A: Discovery should come first whenever the team cannot confidently map all applications, identities, and entitlements in scope. If the review population is incomplete, certification becomes a documentation exercise instead of a control. Prioritise discovery before the next major audit, offboarding cleanup, or recertification cycle.

Technical breakdown

Why IT risk scoring fails when discovery is incomplete

IT risk scoring depends on a closed input set. If the organisation cannot reliably enumerate applications, users, service accounts, tokens and related access paths, then likelihood and impact scores are built on partial evidence rather than operational reality. That is why risk assessment often looks precise while still missing the exposures that matter most. In identity programmes, discovery is not a preliminary admin task. It is the quality gate that determines whether the rest of the assessment is meaningful.

Practical implication: treat discovery coverage as a control prerequisite, not a data-gathering step that can be deferred.

How hidden access paths distort likelihood and impact

Likelihood reflects how probable a threat is, but hidden access paths make probability estimates unstable because the organisation cannot see all the places an attacker or insider could move through. Impact is also distorted when shadow IT, unmanaged SaaS and overlooked service access sit outside the assessment boundary. In that situation, the model underestimates blast radius because the access graph is incomplete. For identity teams, the problem is not only exposure. It is the inability to describe exposure with confidence.

Practical implication: model risk from the actual access estate, including unmanaged SaaS and non-human accounts, before assigning priority.

Why offboarding and review gaps become risk assessment blind spots

The article’s example of an ex-employee retaining access captures a common failure mode in identity governance. Risk assessment is supposed to identify vulnerabilities, but if offboarding is inconsistent or access reviews are stale, the organisation keeps classifying active risk as normal state. The same issue appears with unaudited application access, where the assessment records the system but not the entitlement lifecycle. That makes the score look controlled while the access path remains live.

Practical implication: tie risk assessment inputs to joiner-mover-leaver and access review data so stale access is visible before scoring begins.

NHI Mgmt Group analysis

Identity visibility is the real dependency inside IT risk assessment. Risk models do not fail because organisations lack a way to assign numbers. They fail when the estate being scored is incomplete, which means the most material identities and access paths never enter the calculation. For IAM and NHI governance, assessment quality is therefore an inventory problem before it is a scoring problem.

Shadow IT turns risk assessment into partial accounting. When undiscovered SaaS applications sit outside the asset list, the organisation is not measuring enterprise risk. It is measuring the portion of risk already known to the programme. That is why discovery coverage, access ownership and lifecycle governance are inseparable from risk prioritisation.

Ex-employee access is a governance failure, not just a security finding. The article’s offboarding example shows how quickly a risk framework can misclassify stale access as acceptable if lifecycle controls are weak. This is exactly where IGA and NHI governance converge: if access survives role change or departure, the assessment output will understate exposure by design.

Ephemeral labels do not fix structural visibility gaps. Whether the subject is a user account, SaaS entitlement or non-human credential, the assessment model still depends on complete enumeration and current ownership. Organisations that treat IT risk assessment as a periodic review exercise rather than a continuously updated identity record will keep scoring yesterday’s environment.

Discovery-led risk assessment is the named control gap this article exposes. The underlying assumption is that assets and access can be inventoried well enough to score them. That assumption fails when unmanaged applications, hidden access and incomplete lifecycle data sit outside the programme boundary. The practitioner takeaway is that risk scoring should never be allowed to outrun discovery quality.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: NHI Lifecycle Management Guide

What this signals

Discovery-led risk assessment: identity security teams should treat visibility into applications, accounts and entitlements as the prerequisite for any credible risk score. When the inventory is incomplete, the organisation is not reducing uncertainty, it is merely assigning numbers to gaps.

Risk programmes that ignore non-human access paths will continue to understate exposure because service accounts, API tokens and SaaS entitlements often sit outside human-centric review rhythms. That is why lifecycle data and access ownership need to be maintained together, not in separate governance workflows.

For practitioners

• Reconcile the asset inventory with the access inventory Map every business application, SaaS service, human account and service account to an owner before risk scoring begins. If the risk team cannot tie a system to a responsible owner and lifecycle record, the score is not decision-grade.
• Bind risk assessment to offboarding evidence Require joiner-mover-leaver records, deprovisioning logs and access review outputs as inputs to each assessment cycle. An access path that still exists after offboarding should be treated as an unresolved risk condition, not a completed workflow.
• Include shadow SaaS in the assessment boundary Extend discovery beyond sanctioned systems so unmanaged applications, browser-installed tools and department-owned services are captured before prioritisation. If an app is not in scope, its entitlements will never be scored correctly.
• Separate likelihood from visibility confidence Score risk only after documenting how complete the underlying inventory is. Where discovery is partial, annotate the assessment with confidence limits so leadership does not mistake coverage gaps for low risk.

Key takeaways

• IT risk assessment is only as accurate as the asset and access inventory feeding it, which makes discovery a governance control rather than a preliminary task.
• Hidden SaaS, stale access and incomplete ownership records cause risk scores to understate real exposure and produce false confidence.
• Identity teams should tie risk assessment to lifecycle evidence, access reviews and shadow IT discovery so the scoring model reflects the actual control state.

Key terms

• IT Risk Assessment: A structured process for identifying what could harm systems, data, or operations and deciding how serious that harm could be. In identity programmes, it should include user accounts, service accounts, tokens, certificates, and delegated access, not just infrastructure and applications.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Access Inventory: A map of which identities can reach which systems, why that access exists, and how it is reviewed or removed. For NHI governance, access inventory is more actionable than a simple asset list because it exposes standing privilege and dormant access paths.
• Discovery Coverage: The percentage of the real NHI estate that has been identified across cloud, pipeline, SaaS, and secret-management sources. High discovery coverage is the baseline for lifecycle governance because incomplete visibility makes every downstream control partial and misleading.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.