ITAM best practices in 2026 expose the identity gap

At a glance

What this is: This is an ITAM best-practices article arguing that inventory alone is not enough because governance only becomes meaningful when asset data is tied to lifecycle, renewal, and access decisions.

Why it matters: For IAM and NHI practitioners, the useful lesson is that asset management data becomes security control data only when it informs entitlement, offboarding, and certification workflows.

Context

IT asset management is often treated as a stocktake problem, but the security gap appears when organisations confuse inventory with governance. A list of devices, software, and SaaS subscriptions does not tell you who still has access, which assets are over-deployed, or whether renewal decisions reflect current business need.

That distinction matters to IAM and NHI programmes because asset records increasingly feed joiner-mover-leaver workflows, access reviews, and renewal approvals. When those processes are disconnected, asset visibility improves while entitlement risk remains unchanged.

Zluri's article frames ITAM as an operational discipline, but the identity question is sharper: which assets are tied to active accounts, service access, and renewal authority, and which are not?

Key questions

Q: When does IT asset management fail as a security control?

A: IT asset management fails as a security control when it stops at inventory and never reaches entitlement, offboarding, or renewal decisions. In that state, organisations can know what they own without knowing who still has legitimate access. The result is visibility without governance, which leaves dormant licences, orphaned access, and over-deployment untouched.

Q: Why does renewal governance matter for identity security?

A: Renewal governance matters because it is often the last checkpoint before access, spend, and ownership are extended for another cycle. If renewals are approved without confirming need, organisations preserve stale entitlements and unnecessary cost at the same time. The practical test is whether renewal decisions require an identity or ownership review before approval.

Q: What do security teams get wrong about ITAM automation?

A: Security teams often assume automation is a substitute for governance, when it is really a way to enforce governance faster. Without clear ownership and lifecycle rules, automation can accelerate bad data, stale approvals, and orphaned access. The mistake is wiring tools to reports instead of wiring them to decision points such as onboarding, offboarding, and renewal.

Q: How should organisations connect ITAM to access reviews?

A: Organisations should use ITAM data to trigger access reviews for software, SaaS, and device-related access that no longer matches business need. The review should verify asset ownership, current usage, and whether the entitlement is still justified. This works best when procurement, IAM, and service owners share the same lifecycle evidence.

Technical breakdown

Why ITAM inventory does not equal entitlement governance

ITAM inventory records what assets exist, while entitlement governance records who or what can use them. Those are related but not interchangeable controls. A complete asset register can still leave dormant SaaS accounts, unused licenses, and orphaned access untouched if no lifecycle workflow connects procurement, deployment, offboarding, and renewal decisions. In practice, the security value comes from linking asset state to identity state, not from counting assets more accurately.

Practical implication: connect asset discovery data to access recertification and offboarding triggers so inventory changes affect entitlement state.

How automation changes ITAM for SaaS and access control

Automation in ITAM is not just about faster reporting. It shortens the time between asset change and governance action, which matters when onboarding, offboarding, and renewal decisions happen continuously across SaaS stacks. The control failure in many environments is manual lag: spreadsheets, delayed approvals, and fragmented ownership let unused software and stale access persist after the business need has changed. Automation only helps when it is wired into the decision points that matter.

Practical implication: automate lifecycle events only where they feed approval, renewal, and revocation workflows rather than standalone dashboards.

Why software over-deployment becomes an identity problem

Over-deployment is usually discussed as a licensing or cost issue, but it becomes an identity problem when proof of entitlement is missing or stale. If you cannot demonstrate which user, role, or business function justifies an assigned license, the asset is no longer governed as a controlled service. That turns software compliance into access governance, because renewal, reclamation, and audit response all depend on knowing whether access is still legitimate.

Practical implication: treat license evidence as part of entitlement evidence and use it to decide whether access should continue.

NHI Mgmt Group analysis

ITAM becomes an identity control only when it is tied to entitlement state: Asset visibility by itself does not reduce access risk. The governance break happens when organisations treat discovery, procurement, and renewal as separate from who still has access or who should lose it. That creates a control blind spot across SaaS, software, and device lifecycles, and practitioners should treat asset records as inputs to identity governance rather than as an end state.

Renewal governance is the point where ITAM and IAM converge: Subscription renewal decisions are often the last practical checkpoint before unmanaged access persists for another term. When renewals happen without entitlement review, organisations lock in waste and access drift at the same time. This is where ITAM and IGA should meet, because cost control and access control share the same evidence problem: whether the asset is still justified.

Automation does not fix weak ownership, but it does expose it: The article is right to emphasise automation, yet the real constraint is whether each lifecycle stage has a named owner and an explicit approval path. If onboarding, offboarding, and maintenance are not linked to accountable teams, automation simply accelerates inconsistency. The discipline is not tool-centred; it is ownership-centred, and practitioners should design processes so identity and asset decisions cannot drift apart.

Lifecycle discipline is the named concept that separates ITAM from inventory management: Requisition, procurement, deployment, maintenance, and retirement only work as a governance chain when each stage carries an access implication. That is the identity gap this article exposes: asset management stops being operational housekeeping and becomes security control when retirement, renewal, and offboarding are enforced together. Practitioners should evaluate ITAM through the lifecycle decisions it enables, not the records it stores.

What this signals

Lifecycle discipline is the real control boundary: ITAM only becomes security-relevant when asset records drive onboarding, offboarding, renewal, and review decisions. Organisations that keep inventory and identity governance separate will continue to improve visibility without reducing entitlement risk.

Renewal decisions are governance decisions: The next maturity step is not more discovery, but better linkage between asset ownership, access justification, and licence renewal authority. That is where ITAM starts to influence IAM outcomes instead of merely supporting procurement.

Programmes that can reconcile software usage, ownership, and access state in the same workflow will be better placed to cut waste and reduce dormant access. The operational win comes from making lifecycle evidence reusable across IT, security, and finance.

For practitioners

• Link asset records to entitlement reviews Map SaaS subscriptions, software licences, and device records to the identities that use them so access reviews can validate whether the asset is still justified.
• Tie renewal approvals to ownership checks Require a business owner or system owner to confirm continued need before renewing software or subscription commitments, especially where access and spend are coupled.
• Automate onboarding and offboarding triggers Use lifecycle workflows so new assets create controlled access paths and leavers or movers trigger removal, reassignment, or recertification without manual delay.
• Track over-deployment as an access signal Treat unused or over-assigned licences as evidence that entitlement hygiene is failing, then reclaim or review the associated access before the next renewal cycle.

Key takeaways

• ITAM is no longer just a tracking exercise when organisations use asset data to govern who still needs access and which licences should be renewed.
• The article's core operational lesson is that automation only helps when it shortens the path from lifecycle change to entitlement action.
• Practitioners should treat over-deployment, renewals, and offboarding as connected control points, not separate administrative tasks.

Key terms

• It Asset Management: IT asset management is the discipline of tracking technology assets across their useful life so they can be procured, deployed, maintained, renewed, and retired with accountability. In security programmes, it becomes valuable when lifecycle records are tied to ownership, entitlement, and revocation decisions.
• Entitlement Governance: Entitlement governance is the discipline of deciding who or what should have access, for how long, and under what business justification. It spans human users, non-human identities, and automated workflows, making it a core control layer for SaaS, cloud infrastructure, and lifecycle management.
• Renewal Governance: Renewal governance is the control process that decides whether a subscription should continue, be reduced, or be removed. It connects ownership, usage, contract terms, and budget approval so recurring spend is not allowed to renew automatically without a fresh business justification.
• Lifecycle Evidence: The operational proof that identity events such as provision, review, rotation, and revocation actually happened. For NHIs and AI-linked credentials, lifecycle evidence matters because a control cannot be trusted if the system cannot show who changed what, when, and why.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.