Topic starter
24/06/2026 7:10 pm
TL;DR: 5.7% of organisations report full visibility into service accounts, a SPHERE survey finding that shows privileged account discovery is still incomplete. Identity governance cannot stay current when ownership, recertification, and cleanup start from unseen credentials.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “Nearly Half of Compromised Systems Had Credentials No One Watched — SPHERE’s Intelligent Discovery 2.0 Changes That”.
Key questions
Q: Why do hidden privileged accounts create so much risk?
A: Because attackers target the permission graph, not the admin list.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay.
Q: What breaks when cloud privileged accounts are not continuously discovered and managed?
A: When discovery is incomplete, organisations lose visibility into unknown admins, stale delegated access, and privilege changes that happen faster than manual review cycles.
Practitioner guidance
- Map privileged account sources across all environments Build an inventory that includes cloud roles, local administrator accounts, service accounts, break-glass identities, and on-premises systems so no privileged path is omitted from governance.
- Assign ownership to every privileged account Require a named technical and business owner for each account, with a documented reason for existence and a review cadence tied to that ownership.
- Separate discovered access from governed access Treat discovery output as the input to recertification and remediation, not as evidence that the account has already been controlled.
Bottom line: Incomplete privileged account discovery leaves identity governance partial, because hidden elevated accounts cannot be reviewed or remediated on schedule.
Glossary terms: Privileged Account Discovery, Standing Privilege, Identity Mapping, Identity hygiene
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
25/06/2026 4:20 am
Privileged account discovery is now a governance control, not a reporting feature. When organisations cannot identify every elevated account, they cannot certify, review, or remediate access with confidence. That shifts discovery from an inventory exercise into a prerequisite for PAM and IGA effectiveness. Practitioners should treat missing visibility as a control failure, not a dashboard gap.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do after they detect suspicious privileged account activity?
A: Organisations should immediately block access, investigate the account’s recent actions, and determine whether sensitive data or internal systems were touched. They should also review whether the account is over-privileged, whether social engineering may have been involved, and whether additional monitoring or training is needed to prevent repeat compromise.
👉 Read our full editorial: Privileged account blind spots leave identity governance incomplete