Topic starter
21/08/2026 4:58 pm
TL;DR: Continuous correlation of identity, behavior and threat signals is the finding, with Living Security Human Risk Management Platform citing research that 80% of large companies have faced identity-linked attacks. Identity governance has to fold post-login behavior and threat context into risk decisions, not rely on entitlement review alone.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Identity Risk Management: Connecting Access, Behavior, and Threat”.
By the numbers:
- 80% of large companies have faced a cyber attack linked to user identity.
- 10% of users drive over 73% of risky actions.
Key questions
Q: Why do traditional IAM and PAM controls miss identity attack surface risk?
A: Because they are usually implemented as separate control points rather than one integrated view of the identity estate.
Q: How can organisations know whether identity risk management is working?
A: They should look for measurable reductions in risky access approvals, faster detection of suspicious identity behaviour, and better continuity during incident simulations.
Q: How do security teams tell legitimate access from suspicious behavior?
A: They compare the user’s current actions with role-based baselines and account history.
Practitioner guidance
- Implement identity, behavior and threat correlation Build a single identity risk view that combines HRIS, SSO, endpoint, email and threat signals so access decisions reflect current risk, not just static entitlements.
- Prioritise the risky user cohort Identify the small set of users generating the majority of risky actions and route targeted remediation, monitoring and review effort toward them first.
- Shift remediation to risk-based triggers Define automated responses for anomalies such as unusual location, large data transfers, or identity and threat signal convergence before a breach is confirmed.
Bottom line: Identity risk management is moving from static access checks to continuous correlation of identity, behaviour and threat data.
Glossary terms: Identity Risk Monitoring, Entity Graph, Behavioral Correlation, Human Risk Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/08/2026 5:14 pm
Access-only IAM is now a control boundary problem, not a completeness problem. Traditional entitlement governance can prove who was granted access, but it cannot explain whether the identity became risky after login. That leaves a governance gap between authentication and misuse detection. Practitioners should treat post-authentication behavior as part of the access decision, not as a separate SOC concern.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: Identity risk management is shifting from access checks to threat correlation