Topic starter
12/06/2026 10:23 pm
TL;DR: IAM is being reshaped by credential-led authentication, because password weakness, identity sprawl, and breach persistence have outgrown traditional access management, according to Axiad and CISA. The shift to ICAM makes possession-based credentials central to identity security, but it also raises the bar for lifecycle control and scale.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “IAM is Dead...Long Live ICAM”.
Key questions
Q: How should IAM teams handle shared passwords and shared credentials?
A: IAM teams should treat shared passwords as a control exception that increases risk and weakens accountability.
Q: Why do credentials create less risk than passwords but more governance work?
A: Credentials are harder to guess or reuse than passwords, so they reduce the weakness of knowledge-based authentication.
Q: What breaks when credential management is not scaled with identity growth?
A: The control that breaks is revocation and update consistency.
Practitioner guidance
- Map every credential class Inventory passwords, certificates, passkeys, API keys and machine credentials separately so you can govern each lifecycle explicitly.
- Define issuance and revocation owners Assign accountable owners for issuing, updating and revoking credentials across human, service and machine identities.
- Reduce password dependence Prioritise possession-based authentication for high-risk use cases where shared or reused passwords still create exposure.
Bottom line: IAM is no longer sufficient when password weakness, phishing scale and identity sprawl define the attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 1:06 am
ICAM is really a governance correction, not a naming exercise. The article shows that IAM failed where identity estates outgrew password-led assumptions and where breach conditions made knowledge factors too easy to steal or replay. Credential management now has to be treated as a lifecycle discipline, because issuance, tracking, updating and revocation are what determine whether authentication is defensible at scale.
A question worth separating out:
Q: What is the difference between IAM and identity governance?
A: IAM enforces access at runtime, while identity governance decides which access should exist in the first place and whether it remains appropriate. IAM handles authentication and permission checks. Governance handles policy, approvals, certifications, segregation of duties, and revocation. Both are needed, but governance is what makes access defensible to auditors and risk teams.
👉 Read our full editorial: IAM is dead: why ICAM changes identity security