Notifications
Clear all
Topic starter
08/07/2026 6:59 pm
TL;DR: Active Directory still lacks enough security layers around access to its most valuable resources, according to IS Decisions, and cloud-pushing identity data expands the attack surface while context-aware access and real-time session visibility remain essential. The deeper issue is that identity governance fails when access is not observable where it is actually used.
NHIMG editorial — based on content published by IS Decisions: an interview on Active Directory access control, visibility, and security simplicity
Questions worth separating out
Q: How should security teams control privileged access in Active Directory environments?
A: They should control privileged access at the session level, not only through account provisioning or login events.
Q: Why do contextual access controls matter more than static rules in Windows environments?
A: Static rules often fail in Windows environments because users work across changing devices, locations, and session types.
Q: What do organisations get wrong about identity security in Active Directory?
A: They often treat identity presence as if it were equivalent to access safety.
Practitioner guidance
- Map control to the session, not just the identity record Identify which privileged actions are only visible after login and place monitoring or enforcement at the session layer rather than relying on sign-in logs alone.
- Reduce access decision complexity Review whether your access rules depend on too many exceptions, manual approvals, or admin judgement calls, then simplify the policy set so it can be used consistently.
- Treat identity data location as part of the threat model Assess whether sensitive identity telemetry should remain on-premises or be exported, and document the security justification for any external processing.
What's in the full article
IS Decisions's full interview covers the operational detail this post intentionally leaves for the source:
- How the product integrates directly with Active Directory for Windows access control.
- Why the team prefers on-premises deployment for organisations that do not want identity data pushed outside their network.
- What the new UserLock 13.0 interface changes in practice for administrators.
- How the vendor frames simplicity, deployment speed, and pricing for IT teams working in regulated environments.
👉 Read IS Decisions's interview on Active Directory access control and Zero Trust →
Active Directory access control gaps: what IAM teams need to know?
Explore further
08/07/2026 7:22 pm
Point-of-access control is the missing layer in many identity programmes: Directory-centric security tells you who exists, but not whether access is being used safely in the moment. That gap becomes more serious as work shifts across devices, locations, and sessions that cannot be managed with static directory rules alone. IAM teams should treat the access session as the real control boundary, not the account record.
A few things that frame the scale:
- 57% of organisations lack a complete inventory of their machine identities, according to The Critical Gaps in Machine Identity Management report.
- The same research found that 69% of organisations now have more machine identities than human ones, which means visibility gaps in access governance now affect a larger estate than many teams realise.
A question worth separating out:
Q: Who is accountable for identity security when access data is moved outside the network?
A: The organisation remains accountable for the access risk, even if a cloud provider or external system processes the data. Moving identity telemetry outside the network changes the exposure model, so security, compliance, and architecture teams need to approve that choice as a governance decision, not just a technical convenience.
👉 Read our full editorial: Access control around Active Directory still breaks at the point of access
