Veza’s secops model reframes identity security as a live control plane

At a glance

What this is: This is an analysis of how Veza frames identity security operations around an Access Graph, query-driven investigations, and controlled remediation across the access estate.

Why it matters: It matters because IAM, IGA, PAM, and SecOps teams need a shared view of effective permissions to contain breaches, reduce blast radius, and govern NHIs and humans consistently.

By the numbers:

• The ratio of non-human to human identities now exceeds 25x to 50x in modern enterprises.
• Only 5.7% of organisations have full visibility into their service accounts.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.

👉 Read Veza’s analysis of identity-led security operations and Access Graph workflows

Context

Identity security operations start with a simple problem: teams cannot contain what they cannot see, and traditional access reporting often stops at assigned privileges rather than effective permissions. Veza’s framing reflects a broader shift in IAM and NHI governance, where the real question is not who logged in, but what that identity can actually do to sensitive data and systems.

For security operations, that distinction changes the workflow. Human users, service accounts, tokens, and workloads all carry permissions that may be inherited, indirect, or stale, which makes graph-based permission analysis more useful than spreadsheet-style review. The access model is the control surface, and the operational challenge is proving which identities can reach critical data before damage spreads.

This is especially relevant where non-human identities dominate the estate and Zero Trust expectations require least privilege with continuous verification. The useful reference point is the Ultimate Guide to NHIs, because the same visibility and lifecycle gaps that weaken NHI governance also slow incident containment and audit response.

Key questions

Q: How should security teams contain a compromised identity without losing control evidence?

A: Teams should first map the identity’s effective permissions, then scope access changes through approved workflows that record who authorised the action and what changed. Containment should preserve auditability, ownership, and rollback options. If teams revoke access blindly, they may stop one attacker path while losing the evidence needed for investigation and compliance.

Q: Why do non-human identities increase identity blast radius?

A: Non-human identities often run continuously, hold broad permissions, and connect multiple services at machine speed. If one is compromised or left overprivileged, it can open access to many downstream systems before anyone notices. That makes blast radius a better risk metric than raw asset count.

Q: What breaks when access review is disconnected from incident response?

A: Access review becomes a compliance exercise instead of a control. Teams can identify excessive permissions on paper, but they cannot prove whether those rights are still active, who owns them, or how fast they can be removed when risk appears. That gap leaves the organisation with visibility but no containment capability.

Q: Who should own permission reduction decisions during a security incident?

A: Ownership should sit with the security operation that can correlate identity, data impact, and business risk, but every change should still route through the system owner and access approver. The best model is shared accountability with a single operational record, because identity changes affect both security and production stability.

Technical breakdown

Why effective permissions matter more than assigned access

Effective permissions are the real runtime result of identities, roles, policies, ACLs, group membership, and resource metadata combined. In practice, that means a user or service account may appear constrained on paper while still retaining delete, read, or export rights through inheritance or role chaining. A security operations model built on effective permissions can answer who can do what to which object, which is the question incident response needs first. It also gives auditors a traceable basis for least privilege decisions rather than relying on nominal entitlements.

Practical implication: map permissions at the effective level before you scope containment or attest access.

How graph-based identity queries change investigations

A graph model links identities to downstream resources through direct and inherited relationships, which makes path-aware queries possible. That matters because investigations rarely involve a single permission in isolation. Teams need to know whether a service account can reach production storage through a role chain, or whether a user inherited dangerous rights from nested groups. Query languages like VQL turn that topology into precise hunts, while natural-language interfaces speed the first pass for analysts who need answers in seconds, not hours.

Practical implication: use graph queries to trace privilege paths and inherited rights before making containment decisions.

Why actioning access must stay inside governed workflows

Discovery alone does not reduce risk unless the organisation can change access with approvals, evidence, and rollback discipline. SecOps action layers matter because a containment decision often touches identity providers, ITSM, chatops, SOAR, and cloud platforms at once. The technical requirement is not just automation, but controlled execution that preserves auditability and owner accountability. That is where identity operations intersects with IAM governance, because remediation without evidence creates a new control problem even if it fixes the original exposure.

Practical implication: route access changes through governed workflows that preserve approvals, evidence, and ownership.

Threat narrative

Attacker objective: The attacker objective is to turn legitimate access into broad operational reach before defenders can map and contain the true permission scope.

1. Entry begins when a compromised identity, high-risk alert, or exposed non-human credential creates an immediate permission exposure that the organisation must interpret in context.
2. Escalation occurs when effective permissions, inherited rights, or stale access allow the actor to reach sensitive data or expand blast radius beyond the originally suspected account.
3. Impact follows when containment is delayed and the attacker uses legitimate authorization paths to exfiltrate, delete, or manipulate high-value resources.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• DeepSeek breach — DeepSeek breach exposed 1M+ log lines and sensitive secret keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access graphs are becoming the operational truth layer for identity security. Spreadsheet-centric access review cannot keep pace with inherited rights, nested groups, and machine identities that outnumber humans by orders of magnitude. The field is moving toward permission intelligence because containment and audit both depend on effective access, not theoretical entitlements. Practitioners should treat graph visibility as a core control surface, not a reporting convenience.

Identity security posture management only becomes actionable when it connects to live response. Discovery of toxic access is useful, but the control gap is whether teams can move from finding to enforcement without losing approvals or evidence. That is the difference between posture measurement and security operations. The practical conclusion is that governance and response must share the same identity data model.

Non-human identity sprawl makes blast radius analysis a lifecycle problem, not just a threat problem. Service accounts, tokens, and workloads accumulate rights faster than many organisations can review or revoke them, which is why stale access becomes an incident amplifier. This is why the Ultimate Guide to NHIs matters here: the same visibility and offboarding weaknesses that drive NHI risk also slow secops containment. Practitioners should align lifecycle governance with operational response.

Identity control is shifting from authentication events to authorization outcomes. Login success tells you little if the identity still has standing rights to sensitive data. The market is converging on tools that can prove who can access what, why they can access it, and how quickly that access can be changed. Security teams should re-evaluate whether their current IAM stack can answer those three questions in one workflow.

Named concept, identity blast radius: effective permissions now define the true blast radius of any compromised identity. That includes humans, service accounts, and workloads, because inherited rights make the reachable environment larger than the assigned role suggests. The implication is that access governance must be measured as reachable impact, not just entitlement count.

From our research:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
• From our research: Only 20% have formal processes for offboarding and revoking API keys, according to Ultimate Guide to NHIs.
• From our research: Read the 52 NHI Breaches Analysis to see how delayed revocation turns identity exposure into repeatable breach patterns.

What this signals

Identity blast radius: organisations should expect access containment to remain slower than compromise detection unless effective permissions become a first-class operational metric. The more identities inherit rights across cloud and data estates, the more your response depends on graph-level authorization truth rather than user-centric access records.

The governance gap is no longer visibility alone. Teams now need a response model that can resolve impact, execute change, and preserve evidence inside the same workflow, or identity security will remain split between IAM administration and SOC reaction.

With 96% of organisations storing secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, the operational lesson is clear: privilege drift and secret sprawl should be treated as an ongoing containment problem, not a periodic cleanup exercise.

For practitioners

• Map effective permissions before containment Build incident workflows that resolve identities, groups, roles, ACLs, and inherited rights to the objects they can actually reach. Use that map to decide scope before you revoke or step down access.
• Prioritise high-risk service accounts and tokens Inventory non-human identities with production reach, recent use, and broad write or delete rights. Start remediation with the identities whose blast radius is largest and whose ownership is unclear.
• Route remediation through governed change paths Tie access reduction to ITSM, SOAR, or approval workflows so every containment step produces an audit trail and an accountable owner. Avoid direct manual changes that cannot be reconstructed later.
• Measure containment speed as an identity metric Track time to know and time to contain as identity operations metrics, not just SOC metrics. If permission mapping takes too long, your incident process is still blind to effective access.

Key takeaways

• Identity security operations now depend on effective permissions, because incident response cannot contain what it cannot accurately scope.
• NHI sprawl and inherited access make blast radius analysis a lifecycle issue as much as a threat-response issue.
• Practitioners should connect discovery, approval, and remediation in one governed workflow so access reduction is both fast and defensible.

Key terms

• Effective Permissions: Effective permissions are the access an identity can actually use after role inheritance, scope, and policy are applied. In Azure AI environments, they often matter more than the assigned role name because inherited rights can widen access to data, logs, and secret stores.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Access Graph: An access graph is a relationship model that links identities, permissions, data objects, and system interactions. In NHI governance, it helps security teams see the full path from an agent or user to the action it can take, which is more useful than isolated account reviews.
• Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.

What's in the full article

Veza's full analysis covers the operational detail this post intentionally leaves for the source:

• Access Graph workflow examples that show how identities, roles, policies, ACLs, and resource metadata are resolved into effective permissions
• Access AI and VQL use cases for path-aware hunts across inherited rights, service accounts, and sensitive data objects
• Actions examples showing how containment changes move through ITSM, SOAR, IdP, and chatops with approval evidence
• Proof and measurables for time to know, time to contain, entitlement reduction, and NHI hygiene tracking

👉 The full Veza post covers access graph modelling, query examples, and operational remediation workflows.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.