Notifications
Clear all
Topic starter
24/06/2026 10:13 pm
TL;DR: Identity fabric is framed as a holistic IAM approach that unifies lifecycle, authentication, authorization, governance, federation, and privacy across cloud, mobile, and IoT environments, according to 1Kosmos. The real test is whether that fabric reduces fragmentation and supports zero trust without masking gaps in lifecycle control, privilege management, and interoperability.
NHIMG editorial — based on content published by 1Kosmos: Identity fabric as a holistic IAM approach
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should IAM teams use an identity fabric without creating more sprawl?
A: Treat identity fabric as a coordination layer, not another control plane to administer in isolation.
Q: Why does zero trust depend so heavily on the identity layer?
A: Zero trust assumes every access request is verified continuously and granted only the minimum required access.
Q: What do organisations get wrong about federation in IAM programmes?
A: They often treat federation as a login convenience rather than a governed trust relationship.
Practitioner guidance
- Inventory identity control seams Map where lifecycle, authentication, authorisation, and federation decisions are made in separate tools.
- Validate zero trust prerequisites Check whether continuous verification, least privilege, and context signals are available for every access path.
- Extend governance to service accounts and workloads Review whether non-human identities are covered by the same lifecycle and access review processes as people.
What's in the full article
1Kosmos's full article covers the operational detail this post intentionally leaves for the source:
- The exact identity proofing and authentication features the vendor associates with its identity fabric model.
- Implementation-oriented detail on API and SDK integration patterns across existing infrastructure.
- Product-specific explanations of biometrics, SIM binding, and private blockchain claims that underpin the vendor's approach.
- The vendor's own view of how its architecture fits into cloud-native and federation-heavy environments.
👉 Read 1Kosmos's analysis of identity fabric and zero trust →
Identity fabric and zero trust: where IAM teams should focus?
Explore further
25/06/2026 6:55 am
Identity fabric is a governance model before it is a technology stack. The article is strongest when read as an argument for joining identity controls across lifecycle, authentication, authorisation, federation, and privacy into one operating model. That matters because many IAM failures come from control handoffs, not from a single missing tool. Practitioners should treat fabric as the discipline of making identity decisions consistent across systems, not as a product label.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: How can security teams tell if their identity fabric is actually working?
A: Look for consistent access outcomes, complete lifecycle coverage, and usable audit trails across identity types. If humans, service accounts, and workloads are governed differently for the same kind of access decision, the fabric is not coherent. A working fabric reduces handoff gaps instead of hiding them.
👉 Read our full editorial: Identity fabric is a governance layer, not a security solution
