Zero trust identity governance gaps in hybrid workplaces

At a glance

What this is: RSA Security’s updated analysis says hybrid workplaces create post-authentication identity governance gaps, where access accumulates faster than it is reviewed and revocation lags role change or departure.

Why it matters: IAM, IGA and PAM teams need to treat post-login access governance as a continuous control, because zero trust fails if stale entitlements and dormant accounts remain reachable.

Context

Hybrid work shifts the identity problem from proving who signed in to proving whether access is still justified after authentication. When employees, contractors and partners move across home networks, SaaS tools, cloud resources and on-premises systems, the control gap is not the login itself but the governance that follows it.

RSA Security’s article argues that this post-authentication gap is where entitlement drift, dormant accounts and third-party access become operational risk. That is a classic identity governance and administration problem, and it becomes harder to see when access decisions are spread across multiple directories and review cycles.

The article’s focus is typical of modern hybrid environments rather than an edge case. As access volume rises and review discipline weakens, the attack surface grows quietly inside otherwise legitimate credentials.

Key questions

Q: What breaks when hybrid access is provisioned quickly but never reviewed?

A: Entitlement drift breaks the governance model. Accounts keep permissions long after the business reason has changed, so access becomes broader than intended and harder to revoke with confidence. In hybrid environments, that creates a durable path for misuse because the credential still looks legitimate even when the need has disappeared.

Q: Why do dormant accounts increase breach risk in hybrid workplaces?

A: Dormant accounts are risky because they preserve valid access after the user has left or changed roles. That means attackers do not need to defeat authentication if they can find an identity that was never fully turned off. The risk is highest when remote access and SaaS permissions are not tied to a strict offboarding process.

Q: What are the signs that manual data access governance is failing in a hybrid environment?

A: Common warning signs include fragmented visibility, slow access reviews, unclear ownership of entitlements, and inconsistent least-privilege enforcement across platforms. If teams cannot quickly answer who has access to what, especially for sensitive or AI-fed data, the control model is already lagging. Delayed remediation and repeated compliance findings are strong symptoms of that failure.

Q: How does zero trust change the way teams should think about identity, access, and breach prevention?

A: Zero trust shifts security away from implicit trust and toward continuous verification of users, devices, and access requests. In practice, that means identity controls become central to every access decision, not just login. When paired with IAM, zero trust helps reduce the blast radius of compromised credentials and improves breach resilience across the organisation.

Technical breakdown

Why post-authentication governance fails in hybrid access models

Authentication answers a narrow question: is this identity real right now? Identity governance answers the harder question: should this identity still be allowed to reach this resource in this context? In hybrid workplaces, that answer is often scattered across cloud directories, SaaS platforms, VPNs and on-premises systems. When those entitlement sources are not unified, access reviews become incomplete and de-provisioning lags behind business change. The result is not just poor visibility, but governance drift, where permissions persist after the business reason for them has disappeared.

Practical implication: unify entitlement data before you trust access reviews or revocation decisions.

Dormant accounts and entitlement drift as breach enablers

Dormant accounts are identities that remain active after role change or departure, and entitlement drift is the slow accumulation of permissions that are no longer needed. These two conditions often reinforce each other because rapid provisioning during hybrid expansion is rarely matched by equally disciplined cleanup. Once an account becomes stale, it is easier for attackers to exploit because the access still looks legitimate to surrounding systems. The Colonial Pipeline VPN account example shows how an unused but still valid credential can become a direct path into the environment.

Practical implication: prioritize de-provisioning and entitlement review for accounts that outlive their business purpose.

Why zero trust depends on access boundaries, not just login checks

Zero trust is not satisfied by strong authentication alone. If a valid credential can still move laterally into systems far beyond its business role, then the environment is trusting the account after login. The article’s access governance framing is important because it treats least privilege, RBAC and continuous reviews as the mechanisms that keep a verified identity from becoming a roaming one. In other words, zero trust is enforced by limiting post-authentication reach, not by assuming a secure sign-in solves the problem.

Practical implication: measure whether each authenticated identity can only reach the systems its role genuinely requires.

Threat narrative

Attacker objective: To exploit stale but valid access as a foothold for broader network reach.

1. Entry occurred through a VPN account that was no longer in active use, which means the identity remained valid after the business need had ended.
2. Credential misuse then turned on standing access, because the account still opened a path into the environment despite being dormant.
3. The attacker’s objective was to use legitimate access as a foothold for deeper movement, rather than breaking authentication directly.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Post-authentication governance is the control plane zero trust cannot skip. Hybrid workplaces expose a simple but persistent weakness: authentication is treated as the end of the access decision, when it is really the start of it. Once identity is verified, the governance question becomes whether the entitlement still matches role, context and business need. Practitioners should treat access review and de-provisioning as part of the trust decision, not a downstream administrative task.

Dormant access is a lifecycle failure, not just an access issue. The article’s example of a VPN account no longer in active use illustrates a familiar governance gap: access can survive the reason it was granted. That is exactly why joiner-mover-leaver discipline, de-provisioning automation and recurring certification matter in hybrid environments. The implication is that stale identity states must be treated as an active security condition, not an accounting error.

Entitlement drift is the named concept that best explains hybrid access sprawl. Hybrid working conditions encourage fast provisioning across many tools, but they rarely create matching discipline for entitlement removal. Over time, this creates a layered permission stack that no single team fully owns. For practitioners, the lesson is that governance quality should be judged by how quickly access contracts back to need, not by how quickly it expands to meet demand.

Zero trust becomes incomplete when third-party access sits outside normal review cycles. Contractors, vendors and partners often receive access through separate processes that are not integrated into the main governance rhythm. That leaves implicit trust intact where zero trust expects continuous verification. The practical conclusion is that access governance must cover the full population of identities, including external ones, or the policy boundary is already porous.

RBAC and continuous access review are not separate controls in this model, they are coupled controls. RBAC reduces discretionary sprawl by anchoring permissions to role, while continuous review checks whether the assigned role still makes sense. Used together, they narrow the blast radius of a compromised account and surface privilege creep before it becomes exploitable. Practitioners should align role design and certification cadence rather than treating them as independent programmes.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Hybrid work has exposed a simple governance truth: identity risk is now concentrated after authentication, where access persists, expands and decays in ways that login controls cannot see. Teams should expect their next failure mode to come from permissions that outlive the business reason for them, not from the authentication event itself.

Entitlement drift: this is the gap between access granted for speed and access removed for control. In hybrid programmes, the drift accumulates across SaaS, cloud and remote-access paths, so practitioners need lifecycle controls that shrink permissions back to need rather than merely logging who signed in.

For practitioners

• Tighten post-authentication governance Make access reviews, entitlement changes and de-provisioning part of the zero-trust control set, not separate IAM admin tasks. The goal is to continuously confirm that an authenticated identity still deserves its current access.
• Eliminate dormant account exposure Create a hard process for accounts that remain active after role change, contractor exit or employee departure. Prioritise VPN, SaaS and remote-access credentials because they are the most common residual entry points in hybrid environments.
• Unify entitlement visibility Consolidate identity data from cloud, on-premises and SaaS directories so access reviews are based on one current view of permissions. Without that view, certification becomes approximation and revocation becomes inconsistent.
• Constrain third-party access lifecycles Put contractor and partner access into the same joiner-mover-leaver and certification rhythm as employee access. External identities that sit outside the normal cycle create a long tail of implicit trust.
• Use role design to cut lateral reach Review roles so a valid account cannot wander beyond its business scope if compromised. The practical test is whether one credential can move deeper than its job function requires.

Key takeaways

• Hybrid workplaces create post-authentication governance gaps that authentication alone cannot close.
• Dormant accounts, third-party credentials and entitlement drift widen the path for misuse when access is not continuously reviewed.
• Zero trust in this context depends on continuous access justification, role cleanup and revocation discipline after role change or departure.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
• Dormant account: A dormant account is an identity that has not been used within a defined period but still retains active access. The risk is not only wasted licensing. Dormant access often becomes stale standing privilege, which makes offboarding, certification, and incident response harder to execute cleanly.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.