TL;DR: Nexis argues that OWASP Top 10 2025 still shows broken access control and misconfiguration as universal application risks, but the enterprise failure is usually governance drift across identities, entitlements, third parties, and configuration. The governing assumption that authorization and configuration stay aligned over time no longer holds.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Nexis's blog post: OWASP Top 10 2025 viewed through an identity and governance lens shows that application risk often persists because access, ownership, and configuration drift outpace control updates.
Why it matters: IAM, IGA, PAM, and NHI teams should read this as a reminder that application findings often surface governance failures in identity lifecycle, third-party access, and entitlement validation.
By the numbers:
- OWASP states that 100% of the applications tested were found to have some form of broken access control.
- OWASP states that 100% of the applications tested were found to have some form of misconfiguration.
👉 Read Nexis's analysis of OWASP Top 10 2025 and the enterprise identity reality gap
Context
OWASP Top 10 2025 is an application security benchmark, but this article argues that many of its headline risks are actually symptoms of identity governance failure. The issue is not only whether a control exists, but whether permissions, ownership, and configuration stay aligned as systems, teams, and third parties change.
In enterprise environments, authorization and configuration drift can make secure design look effective on paper while effective access tells a different story. That is why the article frames broken access control, misconfiguration, supply chain exposure, and authentication failure as governance problems that happen to surface inside applications.
Key questions
Q: What breaks when application security findings are really identity governance problems?
A: When access control or misconfiguration is driven by stale entitlements, unclear ownership, or unmanaged third parties, the application becomes the visible symptom rather than the root cause. Teams end up remediating technical issues without fixing the underlying access model, so the same weaknesses reappear as roles, integrations, and configurations change.
Q: Why do excessive privileges create so much access risk?
A: Excessive privileges increase risk because any compromised or misused account can reach more systems, data, and workflows than it should. That widens the blast radius of a mistake or intrusion. The practical issue is not just overpermissioned users, but access that remains in place after duties change or the task ends.
Q: What are the signs that IAM governance drift is creating misconfiguration risk?
A: Look for role definitions that no longer match real job functions, attribute mappings that no longer reflect current policy, and approval rules that do not line up with live access. When governance documents and effective access diverge, the environment is already out of sync with the intended security model.
A: Organisations should treat third party access as an identity governance problem, not just a procurement or network issue. Start by verifying who the external user is, what entity they belong to, and what access they truly need. Then enforce least privilege, review access regularly, and revoke it promptly at engagement end. This reduces orphaned accounts, over-permissioning, and exposure of sensitive enterprise data.
Technical breakdown
Why broken access control becomes identity drift
Broken access control happens when authorization checks do not consistently match the permissions a user, service, or third party should have. In an enterprise, that failure is often less about a single coding bug and more about entitlement drift. Access accumulates, role ownership becomes unclear, and third-party relationships outlive the controls that were meant to constrain them. Once effective permissions diverge from documented intent, application-layer checks can no longer compensate for a governance model that has gone stale.
Practical implication: treat access review outcomes and effective permissions as a control signal, not just a compliance artefact.
How security misconfiguration moves into IAM governance
Security misconfiguration is no longer limited to infrastructure defaults. In this article, the more consequential configuration layer is IAM governance itself: role definitions, attribute mappings, approval rules, and third-party access policies. If those artifacts are not continuously validated against actual access, then the environment can remain technically deployed as intended while still being operationally misaligned. The result is configuration drift at the identity layer, where the system is secure by document but not secure by execution.
Practical implication: validate IAM governance artifacts against live access state and treat deviations as security findings.
Why supply chain risk depends on governed third-party access
Software supply chain failures are usually discussed in terms of compromised code, build systems, or external components. This article widens that lens by showing that identities and service accounts often mediate the real trust boundary. When external parties can administer applications, pipelines, or integrations without tight governance, supply chain risk becomes an access problem as much as a software integrity problem. The control issue is not only what code is trusted, but who can change the conditions under which trust is granted.
Practical implication: govern third-party administrative access with the same rigor as code provenance and deployment controls.
NHI Mgmt Group analysis
Broken access control is increasingly an identity governance failure, not just an application defect. The article is right to treat authorization as an enterprise lifecycle problem because entitlements change continuously while documentation often does not. When access accumulation, role ambiguity, and third-party sprawl outpace review cycles, the application merely exposes the drift already present in governance. The practitioner conclusion is that identity governance has become a front-line application security control.
Security misconfiguration now includes the governance layer that defines effective access. IAM governance documentation, role definitions, and attribute mappings are configuration artifacts with direct security impact. If those artifacts are not continuously reconciled to live access, the organisation can pass policy checks while still running with insecure effective permissions. The practitioner conclusion is that configuration management and identity governance can no longer be treated as separate disciplines.
Third-party access is part of the software supply chain, not a side issue. The article correctly frames external administrators, service accounts, and integrations as trust-bearing actors that shape supply chain exposure. That means supply chain controls must include access governance, not only dependency scanning or pipeline hardening. The practitioner conclusion is that vendor access review belongs in the same control conversation as build integrity.
Authentication failure is often the downstream effect of poor identity hygiene and weak lifecycle governance. Orphaned accounts, dormant users, shared identities, and unmanaged third-party accounts can undermine otherwise sound authentication controls. The important takeaway is that strong MFA or session policy cannot compensate for identities that should never have remained active. The practitioner conclusion is that lifecycle discipline is part of authentication assurance.
Identity reality gap: application controls fail when the enterprise truth about access no longer matches the documented model. This is the article's most useful concept because it captures the mismatch between formal authorization design and effective permissions at runtime. That gap is where broken access control, misconfiguration, and third-party exposure converge. The practitioner conclusion is that governance must be measured against actual access, not assumed design.
What this signals
The identity reality gap will keep widening unless governance teams measure effective access against approved intent, not against static documentation. In practice, that means access reviews, entitlement ownership, and third-party governance need to be tied to live system state rather than periodic assertions.
Identity reality gap: this is the point where documented authorization, deployed configuration, and actual permissions diverge enough that application findings stop being isolated defects and start becoming governance symptoms. For practitioners, the signal is to move entitlement validation and configuration validation into the same control loop.
The strongest programme response is to treat application security findings as triggers for identity and governance investigation. When broken access control or misconfiguration appears, the question should be which permissions, owners, or external relationships allowed it to persist.
For practitioners
- Review effective permissions against documented IAM governance Compare live entitlements, role memberships, and attribute mappings with approved governance artifacts to find authorization drift before it reaches applications.
- Revalidate third-party administrative access Inventory external administrators, integrations, and service accounts that can change applications or pipelines, then confirm each remains explicitly justified and owned.
- Tie misconfiguration findings to access ownership Treat default accounts, stale role mappings, and overexposed permissions as ownership failures and route them into governance workflows instead of isolated hardening tickets.
- Use access reviews to reduce authorization drift Focus reviews on whether users, service accounts, and third parties still need the permissions they actually hold, especially where business roles have changed.
Key takeaways
- OWASP Top 10 2025 still maps to familiar application risks, but the article shows that many of them persist because identity governance has not kept pace with enterprise change.
- The most useful evidence in the article is the repeated pattern of drift across access, configuration, and third-party relationships, which explains why application controls alone do not close the gap.
- Practitioners should connect application findings to access ownership, entitlement review, and third-party governance so the same weakness does not reappear in a new form.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article repeatedly ties risk to excessive and stale access across users, service accounts, and third parties. |
| NHI-03 — Vulnerable Third-Party NHI | Third-party access is central to the article's supply chain and authorization drift argument. | |
| Recommendation — Audit effective permissions for overreach and remove access that no longer matches business need. Review external accounts and integrations as governed identities with explicit ownership and scope. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on whether permissions and authorizations still match intended access. |
| PR.DS-10 — Data in Transit Is Protected | The article includes application security misconfiguration and access pathways that expose protected data. | |
| Recommendation — Continuously validate entitlements against approved authorization intent and remediate drift. Pair access governance with data protection checks where misconfiguration can expose sensitive flows. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is the most direct control response to the article's excessive access and authorization drift. |
| Recommendation — Enforce least privilege across users, service accounts, and third-party access paths. | ||
Key terms
- Identity reality gap: Identity reality gap is the distance between what a governance model says should be true and what effective access actually is. It appears when documented roles, mappings, and approvals no longer reflect live entitlements, especially across third parties and privileged paths. The gap is measured in security exceptions, not intentions.
- Authority Drift: Authority drift occurs when different systems hold conflicting versions of identity data and no clear owner resolves the mismatch. It is a governance failure that leads to duplicate work, stale entitlements, and access decisions based on partial or inconsistent records.
- Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.
- Effective Access: The actual permissions an identity can exercise after inheritance, nested groups, delegation, and object-level controls are evaluated. In Active Directory, effective access is more useful than direct membership because it reveals the true operational reach of a service account.
What's in the full article
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- A category-by-category walkthrough of OWASP Top 10 2025 mapped to governance and identity implications
- The specific Nexis Platform capabilities named in the article, including access reviews, SoD controls, and identity analytics
- The Evidence Collector description and how it is positioned to validate IAM governance documentation against live configuration
- The article's references to ISO 27001, DORA, SOX, and HIPAA as control context for governance design
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org