Topic starter
21/08/2026 4:58 pm
TL;DR: Identity risk management correlates access, behavior, and threat signals to move enterprises from reactive IAM to predictive control, citing research that 80% of large companies have faced identity-linked attacks, according to Living Security Human Risk Management Platform. The implication is that identity governance now has to treat risky behaviour and live threat context as first-class inputs, not just entitlement review.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Identity Risk Management: Connecting Access, Behavior, and Threat”.
By the numbers:
- 80% of large companies have faced a cyber attack linked to user identity.
- 10% of users drive over 73% of risky actions.
Key questions
Q: How do security teams tell legitimate access from suspicious behavior?
A: They compare the user’s current actions with role-based baselines and account history.
Q: Why do traditional IAM and PAM controls miss identity attack surface risk?
A: Because they are usually implemented as separate control points rather than one integrated view of the identity estate.
Q: How can organisations know whether identity risk management is working?
A: They should look for measurable reductions in risky access approvals, faster detection of suspicious identity behaviour, and better continuity during incident simulations.
Practitioner guidance
- Implement identity, behavior and threat correlation Build a single identity risk view that combines HRIS, SSO, endpoint, email and threat signals so access decisions reflect current risk, not just static entitlements.
- Prioritise the risky user cohort Identify the small set of users generating the majority of risky actions and route targeted remediation, monitoring and review effort toward them first.
- Shift remediation to risk-based triggers Define automated responses for anomalies such as unusual location, large data transfers, or identity and threat signal convergence before a breach is confirmed.
Bottom line: Identity risk management is moving from static access checks to continuous correlation of identity, behaviour and threat data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:14 pm
Access-only IAM is now a control boundary problem, not a completeness problem. Traditional entitlement governance can prove who was granted access, but it cannot explain whether the identity became risky after login. That leaves a governance gap between authentication and misuse detection. Practitioners should treat post-authentication behavior as part of the access decision, not as a separate SOC concern.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: Identity risk management is shifting from access checks to threat correlation