Notifications
Clear all
Topic starter
24/06/2026 7:27 pm
TL;DR: Identity teams often face a backlog of orphaned accounts, stale credentials, and policy violations, but Hydden argues that dormant misconfigurations and actively exercised identity gaps should not be prioritised the same way because live usage changes the risk profile. The real shift is from static discovery to active observability, where usage signals determine what gets fixed first.
NHIMG editorial — based on content published by Hydden: identity risk prioritisation needs active usage, not static severity
By the numbers:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should identity teams prioritise findings in a large backlog?
A: Start with activity, not just severity.
Q: Why do active identity gaps create more risk than dormant ones?
A: Active gaps matter because they are already being exercised, which means the organisation may depend on them operationally.
Q: What do teams get wrong about identity backlog triage?
A: They often treat discovery as the main problem when prioritisation is the real bottleneck.
Practitioner guidance
- Split backlog queues by activity state Classify findings as dormant, intermittently used, or actively exercised before assigning remediation priority.
- Correlate identity configuration with event telemetry Join account inventory, entitlement data, and authentication activity so a static policy violation can be evaluated against real usage patterns.
- Escalate daily-used exceptions first Move shared accounts, stale contractor access, and repeated policy violations to the front of the queue when they appear in critical system logs.
What's in the full article
Hydden's full article covers the operational detail this post intentionally leaves for the source:
- How its data mesh correlates account creation, authentication, and entitlement events into a single prioritisation view.
- The mechanics of pushing actively exercised policy violations ahead of dormant findings in a remediation queue.
- Examples of how identity observability changes triage when access has become part of a production workflow.
- The underlying event visibility model that separates configuration state from live identity behaviour.
👉 Read Hydden's analysis of active identity risk versus static findings →
Active identity risk versus static findings: what should teams do?
Explore further
25/06/2026 4:44 am
Static identity severity is not the same as operational risk: A finding that exists on paper and a finding that is exercised daily should not carry the same remediation weight. Identity programmes that rely only on severity scoring flatten this difference and end up treating dormant configuration drift like live exposure. The implication is that prioritisation has to account for usage, not just defect presence.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
A question worth separating out:
Q: How do organisations know when a finding has become operationally embedded?
A: Look for repeated authentication, access in critical systems, and workflow dependence that persists after a policy change. If an entitlement or account keeps appearing in logs and production paths, the issue is no longer isolated configuration drift. It has become part of how the organisation actually works.
👉 Read our full editorial: Identity risk prioritization needs active usage, not static severity
