Topic starter
24/06/2026 6:55 pm
TL;DR: Identity governance tools can only make accurate decisions when they see both access state and activity state, according to Hydden. Without raw activity data, dormant, active, and compromised accounts can look identical, which weakens PAM vaulting, IGA certification, and lifecycle decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “The Identity System of Record”.
Key questions
Q: How should teams govern identity decisions when activity data is incomplete?
A: Treat incomplete activity data as a governance constraint, not just a reporting problem.
Q: Why do PAM and IGA tools misclassify dormant accounts without activity data?
A: Because stateful records show what the account is entitled to do, not whether it has recently done it.
Q: What are the signs that an identity stack is relying on stale data?
A: Look for certification queues built only from access assignments, vaulting decisions that ignore recent use, and remediation outcomes that cannot distinguish inactive from exposed accounts.
Practitioner guidance
- Define activity data as a required input Add raw activity signals such as login history, last access date, and credential exposure context to the identity dataset before running certification or vaulting workflows.
- Correlate stateful and runtime records Join entitlement records to current usage data so dormant privileged accounts do not look identical to dormant low-risk accounts in review queues.
- Re-score privileged accounts with current evidence Use current activity and exposure context to separate accounts that are merely inactive from those that are inactive and risky.
Bottom line: Identity tools become far less reliable when they cannot see actual account activity, because state alone does not show whether an identity is dormant, active, or exposed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:57 am
Activity blindness creates identity false positives and false negatives at the same time: when tools can only see entitlement state, dormant and compromised accounts can be treated as equivalent. That is not a minor visibility issue. It means governance decisions are being made against administrative snapshots instead of operational reality, which weakens both assurance and risk reduction.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How does activity data change lifecycle and access review decisions?
A: It turns lifecycle processes from snapshot reviews into evidence-based decisions. When activity is present, teams can prioritise accounts that are both entitled and recently active, rather than spending equal effort on all accounts that merely exist in the directory.
👉 Read our full editorial: Identity tools fail when activity data is missing