Notifications
Clear all
Topic starter
24/06/2026 10:37 pm
TL;DR: Unifying data classification and identity security so teams can answer who has access to sensitive data, what that access risks, and how to prioritise remediation across human, non-human, and AI identities, Saviynt’s collaboration with Cyera centers on that shift, which makes access governance more contextual but also exposes how much IAM still depends on incomplete data visibility.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams use data classification to improve access reviews?
A: Security teams should use data classification to rank access reviews by exposure, not by entitlement count alone.
Q: Why does sensitive data make overprivileged access more dangerous?
A: Sensitive data increases the blast radius of every excess permission.
Q: What breaks when access reviews do not include data sensitivity?
A: Access reviews without data sensitivity tend to normalise risky permissions because they treat every entitlement as equally important.
Practitioner guidance
- Map sensitive data to entitlement records Link classification labels to roles, entitlements, and shared accounts so certification workflows can rank the highest-exposure permissions first.
- Prioritise high-risk reviews by data sensitivity Move away from equal-weight access recertification and target identities with access to regulated or confidential data before routine low-risk entitlements.
- Right-size privileged and shared access with context Apply just-in-time access where elevation is needed, but validate the target data’s sensitivity before granting the session.
What's in the full announcement
Saviynt's full article covers the operational detail this post intentionally leaves for the source:
- Agentless AI classification mechanics for identifying which identities can reach sensitive data stores.
- Policy automation detail for revoking or right-sizing access without manual ticket handling.
- Reporting and audit-trail examples that show how access was granted, reviewed, and removed.
- Risk-based certification workflow examples for prioritising high-risk identities and sensitive datasets.
👉 Read Saviynt's article on unifying identity access and data exposure →
Data exposure and identity access: what IAM teams need to know?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 7:22 am
Unified identity and data intelligence is becoming the missing control plane for access governance. IAM programmes have spent years answering who has access, but the more relevant question is what that access creates risk against. When classification is fused with entitlement data, certification, remediation, and audit all become more precise. The implication is that access governance is moving from entitlement management to exposure management.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity teams are certifying access without a complete inventory, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own identity and data exposure decisions in a governance programme?
A: Ownership should sit with the identity governance function, but it must be informed by data owners, security operations, and compliance teams. Identity teams manage the entitlement, data teams classify the asset, and security teams respond when exposure becomes actionable. That shared model prevents access decisions from being made in isolation.
👉 Read our full editorial: Unified data and identity security raises the bar for access governance
