Topic starter
24/06/2026 8:52 pm
TL;DR: Digital identity management depends on authentication, authorization, administration, and auditing working together, but weak passwords, fragmented systems, insider risk, and regulatory pressure continue to expose people and machines, according to 1Kosmos. The real issue is not login friction alone, but whether identity governance can follow the full lifecycle without leaving orphaned access behind.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What Is Digital Identity Management & How to Do It Right”.
Key questions
Q: Where does digital identity management usually fail in practice?
A: It usually fails when authentication, authorization, administration, and auditing are split across different tools or teams.
A: Basic controls still matter because many breaches begin with weak credentials or account takeover, not advanced exploits.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Practitioner guidance
- Consolidate identity source-of-truth records Build a single view of human and machine identities so provisioning, role assignment, and retirement decisions do not diverge across platforms.
- Extend lifecycle governance to machine identities Include certificates, tokens, keys, and cloud credentials in the same joiner-mover-leaver and review workflows used for human access.
- Reduce password dependence where phishing resistance is possible Prioritise passwordless and phishing-resistant authentication for populations where the article’s password risk is highest, then align those changes with reporting and administration controls.
Bottom line: Digital identity management fails most visibly when the controls that issue, authorize, and retire identities no longer share a common governance model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:43 am
Identity governance fails when administration and auditing are detached from authentication. The article describes DIM as a lifecycle discipline, but many programmes still treat authentication as the visible control and everything else as back office. That split creates governance blind spots, because access can be granted, changed, and forgotten without a consistent audit trail. The consequence is not just weaker security, but identity state that no one can reliably certify or retire.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should security teams do when IAM governance spans human and machine identities?
A: They should apply the same lifecycle discipline to both populations while preserving identity-specific review logic. That means ownership, offboarding, recertification, and entitlement scope must be defined consistently, even if the workflow steps differ between people and non-human identities.
👉 Read our full editorial: Digital identity management still fails where governance fragments