Notifications
Clear all
Topic starter
17/08/2026 4:42 pm
TL;DR: MFA and SSO reduce unauthorised logins, but they do not control what happens after access is granted, according to Clarity Security. The real governance gap is post-authentication privilege scope, which makes IGA, least privilege, and RBAC the controls that contain blast radius when credentials are compromised.
NHIMG editorial — based on content published by Clarity Security: why MFA and SSO are not enough without identity governance
By the numbers:
- 17 minutes and as quickly as 9 minutes, cly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern access beyond MFA and SSO?
A: Security teams should treat MFA and SSO as authentication controls, not governance controls.
Q: Why do MFA and SSO not stop privilege abuse once access is granted?
A: Because they verify the login event, not the permissions attached to that identity.
Q: What do security teams get wrong about least privilege in hybrid environments?
A: They often review the visible role and miss the effective access created by nested groups, federation, and inherited permissions.
Practitioner guidance
- Separate authentication from authorisation governance Map MFA and SSO to the login boundary, then assign IGA ownership for entitlement scope, access duration, and review cadence.
- Review effective access, not just assigned roles Inspect nested groups, inherited permissions, and federated access paths to identify what an account can actually do in production systems.
- Use RBAC to limit downstream privilege spread Refine roles so they map to current job functions and remove broad or historical permissions that no longer have a business owner.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- 10-minute access review workflow design and the review filters used to narrow entitlement scope
- Native RBAC configuration examples for birthright access and role-based entitlement assignment
- Real-time visibility into nested groups and federated access in complex hybrid environments
- Machine-learning-based risk detection for unusual access patterns and separation-of-duties conflicts
👉 Read Clarity Security's analysis of why MFA and SSO are not enough for identity governance →
MFA and SSO are not enough, so what should IGA teams do?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:47 pm
MFA and SSO are authentication controls, not governance controls. Their value is real, but limited to the login boundary. Once a session is established, the security question becomes authorisation scope, not authentication strength. Practitioners should stop treating sign-in assurance as a proxy for access containment.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: What should IAM teams do when access reviews do not lead to revocation?
A: They should treat the process as ineffective until it can produce verified removal. Access reviews that do not remove stale or excessive entitlements create a false sense of control, especially for privileged and non-human identities. The fix is to link certification workflows to enforced revocation and exception tracking.
👉 Read our full editorial: MFA and SSO do not close the identity governance gap
