Topic starter
09/07/2026 1:39 pm
TL;DR: Permiso is framing identity risk as a continuous 0 to 100 score built on a Universal Identity Graph, with separate behavior, likelihood and impact dimensions, plus score velocity and organization-level benchmarking, according to Permiso Security. The real shift is not the number itself, but the move away from fragmented tooling that cannot see across human, NHI, and AI agent identity context.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “Introducing the Risk Score Engine: identity risk you can quantify”.
Key questions
Q: What breaks when identity risk scoring only sees one part of the environment?
A: Scoring becomes a local ranking exercise rather than a reliable governance signal.
Q: Why do behavior, likelihood, and impact need separate risk dimensions?
A: Because they answer different operational questions.
Q: How should security teams use score velocity in identity governance?
A: Use it as an early warning indicator rather than a background metric.
Practitioner guidance
- Unify identity inventories Map humans, service accounts, API keys, tokens, IAM roles, and AI agents into one governed identity graph so scoring can follow real access relationships instead of tool boundaries.
- Separate score dimensions in operations Keep behavior, likelihood, and impact visible as distinct signals so analysts can see whether a score changed because of anomalous activity, compromise probability, or blast radius.
- Treat score velocity as a response trigger Prioritise identities whose risk changes sharply over short periods, because rapid movement often matters more than a stable high score for immediate containment and review.
Bottom line: Identity risk scoring becomes weak when it is built from partial visibility and cannot compare humans, NHIs, and AI agents in one model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 1:42 pm
Identity risk scoring is only defensible when the underlying model sees the whole identity estate. A score built from one tool family or one identity slice is not a governance control, it is a local approximation. The practical issue is not whether the number looks consistent, but whether it reflects human, NHI, and AI agent context in the same frame.
A question worth separating out:
Q: How can IAM teams decide whether a risk score is trustworthy?
A: A risk score is trustworthy when it is traceable to evidence across the full identity graph and when the score still makes sense after the identity context changes. If the number cannot explain itself across humans, NHIs, and AI agents, it is closer to an alert label than an operational control.
👉 Read our full editorial: Identity risk scoring needs a unified model, not another alert layer