Notifications
Clear all
Topic starter
11/08/2026 3:25 pm
TL;DR: Configuration scanners can confirm that controls are enabled, but they cannot show whether MFA, IAM roles, or network segmentation are being bypassed in practice, according to Artemis Security. Behavioral analysis over activity data is becoming the missing layer between policy intent and real security behavior, especially where identity and access patterns drift over time.
NHIMG editorial — based on content published by Artemis Security: Posture as Behavior, Not Configuration
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: What breaks when security teams rely only on configuration posture data?
A: Teams lose sight of the difference between a control being enabled and a control actually being enforced.
Q: Why do identity and access controls need behavioural validation?
A: Because identity controls are often undermined in operation by legacy authentication, unexpected principals, and access patterns that expand beyond the original policy intent.
Q: How do security teams know if posture analytics is producing useful results?
A: Useful posture analytics should produce findings that are specific, reproducible, and tied to a clear action.
Practitioner guidance
- Implement behavioural verification for priority identity controls Start with one control that is assumed to be working, such as MFA, privileged access, or role scoping, and compare policy state with real activity data from the systems where access is used.
- Audit legacy authentication and override paths Identify every path that can weaken a control without changing its configuration, including legacy protocols, manual overrides, and exception rules.
- Require investigation trails for AI-generated findings Do not accept behavioural findings unless the system can expose the query logic, source events, counts, and reasoning behind each conclusion.
What's in the full article
Artemis Security's full article covers the operational detail this post intentionally leaves for the source:
- The telemetry pipeline design that turns CloudTrail, Okta, Entra, GitHub, and endpoint data into structured behavioural analysis.
- The query-extraction approach used to isolate identity type distributions, session ratios, and anomalous access patterns.
- The investigation-trail structure that records queries, observations, and conclusions for every finding.
- The example of how a deprecated service created millions of avoidable API calls and inflated security data costs.
👉 Read Artemis Security's analysis of behavioural posture and security control drift →
Behavioral posture analysis: are your controls doing what you think?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
11/08/2026 3:34 pm
Behavioural posture is a governance upgrade, not a new control category. Configuration tools tell teams what was set, but not what the environment is doing under load, exception, and drift. That distinction matters because many identity failures begin as policy-compliant settings that are slowly undermined by actual use. For IAM and NHI programmes, the relevant question is whether access behaviour still matches the control intent you think you deployed. Practitioners should treat activity data as the proof layer for policy enforcement.
A question worth separating out:
Q: Who is accountable when a control looks compliant but fails in practice?
A: Accountability sits with the control owner and the governance team responsible for proving operational effectiveness, not just configuration status. Frameworks such as NIST CSF and NIST SP 800-53 expect controls to be monitored and validated, which means teams must be able to demonstrate behaviour, not merely declared settings.
👉 Read our full editorial: Behavioral posture is exposing the gap configuration tools miss
