TL;DR: Enduring companies are shaped by repeated near-failures, including a 70% sales miss during Okta's 2011 Series B, and by people who behave like owners when pressure rises, according to Cogent's interview with Okta co-founder Frederic Kerrest. The same pattern applies to identity programmes: governance holds only when teams own outcomes, not just controls.
At a glance
What this is: This interview frames company endurance as the product of repeated setbacks, ownership, and culture rather than a smooth growth story.
Why it matters: For IAM and identity leaders, the lesson is that programmes survive stress when accountability is distributed across the team, not concentrated in a single leader or control owner.
Context
The article is about organisational resilience and ownership, not a product capability. Its central claim is that great companies are shaped by the way teams respond when plans break, and that culture is built through behaviour rather than slogans.
For identity practitioners, that maps to governance programmes as much as it does to company building. Access, lifecycle, and control ownership only work when the people operating them act like stewards, not passengers.
Key questions
Q: How should identity teams keep governance from turning into checkbox work?
A: Tie each control to a named owner, a measurable outcome, and a visible workflow. When people can see how the process is supposed to operate, they are more likely to repeat the right behaviour and less likely to treat reviews, approvals, and exceptions as paperwork.
Q: Why do connector gaps matter so much in IAM and NHI programmes?
A: Connector gaps matter because they hide the permissions that actually determine risk. If a connector only confirms login or account presence, teams cannot reliably review entitlements, detect drift, or revoke the rights that attackers abuse. That leaves human users and non-human identities governed at the wrong layer, which weakens auditability and control enforcement.
Q: How do organisations know if their identity programme is keeping pace with the business?
A: They should measure how quickly access decisions change relative to role, application, and environment churn. If reviews, removals, and recertifications lag behind business change, the programme is not keeping pace. A strong identity programme absorbs change without letting entitlement drift become the default.
Q: What is the difference between culture and policy in identity security?
A: Policy describes the intended rule, while culture is the behaviour people actually model when no one is watching. In identity security, culture determines whether controls are followed consistently or ignored until a problem forces attention.
Technical breakdown
Why culture changes faster than org charts
Culture is the set of behaviours people learn by watching what actually gets rewarded, tolerated, and repeated. In identity programmes, that matters because the operating model around approvals, reviews, and exception handling is usually stronger than the written policy. If a team treats access reviews as a checkbox, the programme becomes checkbox governance. If the team treats them as an ownership mechanism, the same control starts to change decisions. Practical implication: design identity governance so the day-to-day behaviour you want is the behaviour people can see and copy.
Practical implication: Make the operating pattern visible, because teams learn identity governance from what colleagues actually do.
Why ownership beats hierarchy in recurring risk work
The interview argues that nobody is in charge of your career but you, and that ownership matters more than title when problems are hard. The same logic applies to IAM, PAM, and NHI governance. A manager can assign responsibility, but only the operators can close the loop on recertification, access exceptions, and lifecycle cleanup. Without explicit ownership, controls drift into shared ambiguity. Practical implication: identity programmes need named owners for every recurring control, not just a policy owner at the top.
Practical implication: Assign explicit control owners for recertification, exceptions, and offboarding so accountability cannot drift.
What a written plan changes in governance programmes
A written plan forces people to state where they are going, how they will get there, and how they will know they have arrived. In governance terms, that is the difference between vague improvement and measurable control maturity. Identity programmes need the same discipline for access reviews, privileged access, and NHI lifecycle management: a destination, a method, and a way to verify progress. Practical implication: if a governance activity cannot be described in those three terms, it is not yet a managed programme. See the Okta Security Hardening Guide.
Practical implication: Translate governance work into destination, method, and measurement before you call it a programme.
NHI Mgmt Group analysis
Ownership is the hidden control plane of identity governance. Kerrest's point that culture is shaped by what people around you do maps cleanly to IAM and NHI programmes: controls are only as strong as the behaviour they produce. Policies do not enforce themselves, and identity failures often begin when responsibility is diffuse. The practitioner takeaway is to treat ownership as an operational control, not a management style.
Durable programmes are built by people who act like stewards, not by people waiting for escalation. Identity teams routinely depend on escalation paths, but the strongest programmes reduce the need for escalation by making responsibility visible at the point of work. That applies to access review owners, NHI custodians, and PAM operators alike. The practitioner takeaway is to make ownership observable in the workflow, not just on an org chart.
Written goals matter because governance without measurable intent becomes ceremony. Kerrest's three-part plan mirrors what mature identity programmes need: a target state, a method, and a way to know whether the control actually changed behaviour. This is especially relevant when teams are managing recurring exceptions, manual approvals, or lifecycle debt. The practitioner takeaway is to define governance objectives in terms that can be revisited and tested, not merely stated.
Great companies and mature identity programmes both fail when they confuse continuity with control. A company can keep moving while still drifting, and an IAM programme can keep running while losing discipline. The hard years expose whether the organisation truly owns its processes or simply inherits them. The practitioner takeaway is to inspect where identity operations depend on habit rather than accountable execution.
What this signals
Control ownership becomes the real maturity signal when programmes scale. Identity teams often talk about policy completeness, but the harder question is whether the people running the process behave as stewards when the work gets messy. If ownership is unclear, recertification, offboarding, and exception handling degrade first, and the programme becomes harder to trust.
Written intent is only useful when it survives contact with daily operations. The practical test for IAM and NHI governance is whether goals, methods, and review cycles still make sense after the team changes, the workload grows, or the control fails once. Programmes that cannot be explained and revisited in simple terms usually lose discipline as soon as pressure increases.
For practitioners
- Define named owners for recurring identity controls Assign an accountable person for each recurring process, including access reviews, exception handling, privileged access, and NHI lifecycle cleanup.
- Write a three-part governance plan Document the destination, the operating method, and the evidence you will use to know the control is working.
- Make control behaviour visible to the team Expose how approvals, reviews, and escalations actually happen so new operators learn the expected standard from day one.
- Review where accountability is only implied Look for identity processes that depend on informal ownership, then convert them into explicit responsibilities with clear handoffs.
Key takeaways
- The article's core message is that enduring companies are shaped by repeated setbacks and by people who behave like owners.
- For identity practitioners, the transferable lesson is that governance depends on visible accountability, not just documented process.
- Programmes mature when control ownership, method, and measurement are explicit enough to survive pressure and staff turnover.
Related NHI Mgmt Group resources: Identity Provider and SSO Security Guide · Okta Security Hardening Guide · MFA Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RR-01 — Roles, Responsibilities, and Authorities | The piece centres on ownership and accountability in operating identity programmes. |
| GV.OC-01 — Organizational Context | The article frames culture and company purpose as drivers of durable governance behaviour. | |
| GV.PO-01 — Cybersecurity Policy | The interview contrasts written intent with the behaviour needed to make governance work. | |
| Recommendation — Define clear roles, responsibilities, and authorities for identity controls so ownership does not remain informal. Align identity governance decisions to organisational context so controls reinforce the way the team actually works. Turn policy into repeatable operating practice and verify that it changes how controls are executed. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Control Behaviour: Control behaviour is the way a security or governance process is actually carried out in daily operations, not how it is described in policy. In identity programmes, behaviour determines whether reviews, approvals, and handoffs reduce risk or become ceremonial tasks that drift over time.
- Governance Maturity: The degree to which an organisation can consistently assign ownership, assess risk, monitor behaviour, and intervene when needed. In AI programmes, maturity is shown by evidence of operating controls, not by policy statements or one-time compliance checks.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org