Topic starter
25/08/2026 6:10 pm
TL;DR: DORA compliance depends on identity security visibility across users, third-party vendors, non-human identities, and AI agent identities, according to Veza, because traditional IAM, IGA, and PAM tools do not expose the authorization detail needed for resilience. That makes granular entitlement mapping a governance requirement, not an operational nice-to-have.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “DORA Compliance for Financial Institutions: Strengthening Identity Security”.
Key questions
Q: What breaks when teams only track identity accounts instead of effective permissions for DORA?
A: They lose the ability to prove who can actually perform regulated actions, which weakens incident response, recovery, and third-party risk governance.
Q: Why do third-party and non-human identities increase resilience risk?
A: Third-party and non-human identities often carry legitimate trust but limited lifecycle control, which makes them ideal pivot points once an attacker gets a foothold.
A: They should test whether they can answer who has access to what and what actions each identity can perform across critical systems, vendors, and automation.
Practitioner guidance
- Inventory effective privileges across all identity types Build a single view that maps users, third parties, service accounts, tokens, and AI agent identities to the actions they can actually perform in production systems.
- Separate dormant access from active business need Review dormant, orphaned, and vendor-held access for current operational necessity, then remove permissions that survive only because no owner has challenged them.
- Extend resilience testing to authorization paths Test whether incident response and recovery teams can identify privileged paths quickly enough to contain disruption when access spans nested roles and external identities.
Bottom line: DORA pushes financial institutions to prove more than identity inventory. They need visibility into effective permissions across people, vendors, machines, and AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
DORA is forcing identity security out of the IAM silo and into resilience governance. Financial institutions can no longer treat identity visibility as an admin function that supports joiner-mover-leaver hygiene. Once resilience is regulated, entitlement clarity becomes part of proving that critical services can withstand, contain, and recover from ICT disruption. The practical conclusion is that identity governance and operational resilience are now the same control conversation.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do AI agent identities change access governance compared with human users and service accounts?
A: AI agents can require task-specific access that is created, used, and retired differently from human or static machine accounts. That means conventional review cycles may miss the moment when privilege is actually exercised. Financial institutions need a governance model that treats agents as distinct identity subjects with runtime access patterns.
👉 Read our full editorial: DORA exposes the identity visibility gap in financial resilience