Notifications
Clear all
Topic starter
21/08/2026 4:56 pm
TL;DR: Digital identity and process platforms are increasingly positioned as the control layer for regulated digital services in Europe, with KOBIL arguing that NIS2, EUDI Wallet adoption, CRA obligations, and AI-driven identity abuse are forcing organisations away from fragmented systems and toward integrated orchestration, according to KOBIL. The governance shift is less about adding another tool than about aligning identity, process control, and auditability across human, service, and state-verified identities.
NHIMG editorial — based on content published by KOBIL: Digital identity and process platforms are becoming a 2026 control layer
By the numbers:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- Only 5.7% of organisations have full visibility into their service accounts.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
Questions worth separating out
Q: How should security teams govern identity and process workflows in regulated environments?
A: They should define a single control path for authentication, entitlement decisions, approvals, logging, and exception handling.
Q: Why does fragmented identity tooling increase audit risk?
A: Fragmented tooling forces auditors to reconcile separate logs, approval records, and revocation events across products that do not share the same state.
Q: When does orchestration become more important than authentication?
A: When the business outcome depends on more than proving a user is real.
Practitioner guidance
- Map identity evidence to each high-risk process step Document where identity is asserted, where entitlements are checked, where approvals occur, and where audit evidence is written for every regulated workflow.
- Consolidate policy enforcement into the transaction path Move high-risk decisions into the runtime path so role, device, location, and regulatory conditions are evaluated before the workflow completes.
- Separate orchestration from point solutions in your target architecture Define which systems own identity, which own process control, and which merely integrate, then remove duplicate approval logic that weakens evidence quality.
What's in the full article
KOBIL's full article covers the architectural and market detail this post intentionally leaves for the source:
- Detailed breakdown of how the identity, security, process, and client layers are separated in the mPower architecture.
- Sector-specific use cases for banking, public administration, critical infrastructure, and regulated services.
- Discussion of how the platform supports eIDAS, GDPR, DORA, and NIS2-aligned workflows.
- Outlook on AI-based anomaly detection and decentralized identity support within the broader platform model.
👉 Read KOBIL's analysis of digital identity and process platforms for 2026 →
Digital identity and process platforms: are IAM teams ready for 2026?
Explore further
21/08/2026 5:13 pm
Digital identity and process platforms are becoming a governance layer, not just an IAM layer. The article is right to frame orchestration as central to regulated digital services, because identity alone no longer explains whether a transaction is trustworthy. IAM can authenticate a subject, but it cannot by itself prove that policy, approval, and evidence stayed aligned across the workflow. Practitioners should treat platform architecture as a governance design choice, not a deployment convenience.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how weak identity observability remains in many programmes.
A question worth separating out:
Q: What should organisations do before adopting state-verified digital identities?
A: They should decide how those identities will map to internal entitlements, workflow rules, revocation processes, and logging. Without that governance layer, external identity assertions can be trusted at login but remain weakly controlled during the transaction itself.
👉 Read our full editorial: Digital identity and process platforms are becoming a 2026 control layer
