Topic starter
24/06/2026 7:10 pm
TL;DR: Unmanaged and unmonitored credentials leave identity teams operating with incomplete governance and remediation context, as SPHERE’s Intelligent Discovery 2.0 focuses on privileged account visibility across cloud and on-premises systems. Hidden privileged access is now an identity hygiene problem, not just a visibility gap.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “Nearly Half of Compromised Systems Had Credentials No One Watched — SPHERE’s Intelligent Discovery 2.0 Changes That”.
Key questions
Q: What breaks when cloud privileged accounts are not continuously discovered and managed?
A: When discovery is incomplete, organisations lose visibility into unknown admins, stale delegated access, and privilege changes that happen faster than manual review cycles.
Q: Why do hidden privileged accounts create so much risk?
A: Because attackers target the permission graph, not the admin list.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay.
Practitioner guidance
- Map privileged account sources across all environments Build an inventory that includes cloud roles, local administrator accounts, service accounts, break-glass identities, and on-premises systems so no privileged path is omitted from governance.
- Assign ownership to every privileged account Require a named technical and business owner for each account, with a documented reason for existence and a review cadence tied to that ownership.
- Separate discovered access from governed access Treat discovery output as the input to recertification and remediation, not as evidence that the account has already been controlled.
Bottom line: Incomplete privileged account discovery leaves identity governance partial, because hidden elevated accounts cannot be reviewed or remediated on schedule.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:20 am
Privileged account discovery is now a governance control, not a reporting feature. When organisations cannot identify every elevated account, they cannot certify, review, or remediate access with confidence. That shifts discovery from an inventory exercise into a prerequisite for PAM and IGA effectiveness. Practitioners should treat missing visibility as a control failure, not a dashboard gap.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do after they detect suspicious privileged account activity?
A: Organisations should immediately block access, investigate the account’s recent actions, and determine whether sensitive data or internal systems were touched. They should also review whether the account is over-privileged, whether social engineering may have been involved, and whether additional monitoring or training is needed to prevent repeat compromise.
👉 Read our full editorial: Privileged account blind spots leave identity governance incomplete