Topic starter
23/06/2026 9:06 pm
TL;DR: Clarity Security says identity governance has been treated as compliance evidence and periodic review, but that model leaves risk to accumulate between cycles because it does not continuously assess access or close exposure when it appears. The shift matters because governance alone cannot prove access is appropriate, limit blast radius, or handle non-human and AI identities at the pace they now operate.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “Clarity Security Launches Aperture, Moving Identity Security Beyond Governance”.
By the numbers:
- AI-related breaches affected organizations that lacked proper AI access controls in 97% of cases, according to IBM’s 2025 Cost of a Data Breach report cited by Clarity Security.
Key questions
Q: What breaks when access reviews are the primary identity control?
A: The control breaks because access can change, be abused, and disappear between review cycles.
Q: When should organisations prioritise continuous risk scoring over periodic certification?
A: When identity relationships change faster than the review cycle can capture them, continuous scoring should come first.
Q: How do security teams know whether identity governance is reducing risk?
A: Look for shorter time from access change to visibility, fewer unmanaged entitlements, and faster completion of review and remediation cycles.
Practitioner guidance
- Map review cadence to exposure decay Identify where access reviews are still being used as the primary risk control and mark those paths for continuous evaluation instead.
- Create a live remediation path for high-risk identities Require every high-risk identity finding to have an executable closure path in the same platform or workflow that detected it, so remediation does not depend on ticket handoff.
- Separate NHI governance from human attestation Build a distinct ownership, inventory, and escalation model for service accounts, API keys, bots, OAuth apps, and AI agents rather than folding them into human access reviews.
Bottom line: Identity governance that stops at approval and certification leaves a live risk window open between review cycles.
What's in the full announcement
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- The dynamic risk scoring model used to rank identity exposure across human and non-human identities
- How the platform maps nested permissions, federated access, and blast paths into a remediation workflow
- The NHI & AI Security module’s coverage of service accounts, API keys, OAuth apps, bots, and AI agents
- The evaluation feedback and customer commentary that illustrate how practitioners are positioning unified identity security
👉 Read Clarity Security's analysis of continuous identity risk and adaptive trust →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:13 am
Access review is not a risk control: It was designed to prove that access was approved, not to determine whether access is safe today. That assumption fails in environments where identity posture changes continuously across cloud, SaaS, and machine identities. The implication is that identity programmes must stop treating certification as the point of control and start treating it as one evidence layer among many.
A question worth separating out:
Q: What is the difference between governance evidence and identity risk reduction?
A: Governance evidence proves that access was reviewed, approved, or documented. Identity risk reduction proves that exposure was identified and actually closed. The two can overlap, but they are not the same control outcome, and treating them as equivalent leaves a blind spot between audit readiness and real security.
👉 Read our full editorial: Clarity Aperture reframes identity governance around continuous risk