Topic starter
28/07/2026 6:15 pm
TL;DR: Financial services firms that run IAM and PAM as separate domains create inconsistent enforcement, fragmented audit evidence, and manual reconciliation overhead, according to Hitachi ID’s analysis. The governance gap is not theoretical: access controls that cannot be traced end to end are operationally weak and harder to defend under scrutiny.
Editorial analysis by NHI Mgmt Group, based on content published by Hitachi ID: “IAM and PAM Integration Strategies”.
Key questions
Q: How should security teams connect IAM approvals to PAM enforcement?
A: They should design a workflow where an approved identity request triggers the corresponding privileged control action automatically, with shared attributes carrying the business context into PAM.
Q: Why do separate IAM and PAM systems create audit problems?
A: Because approval evidence, runtime privilege, and session records end up in different systems, auditors cannot easily prove that the access granted was the access used.
Q: What breaks when privileged access is not routed through PAM?
A: When privileged actions bypass PAM, organisations lose the controls that make elevation accountable.
Practitioner guidance
- Define one access control chain Map how an approval in IAM becomes a runtime enforcement action in PAM, including the identity attributes that must survive the handoff.
- Align audit evidence sources Create a common reporting view so access requests, privilege sessions, and revocation events can be reconciled without manual stitching.
- Bring password governance into scope Include credential rotation, recovery, and delivery for legacy applications and service accounts that sit outside standard identity workflows.
Bottom line: IAM and PAM separation creates a structural governance gap because approval and runtime enforcement are not automatically the same control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:56 pm
IAM and PAM separation is a governance architecture problem, not a product gap. When approval lives in one system and privilege enforcement lives in another, the organisation has two partial control planes instead of one defensible access model. That split weakens auditability, slows incident response, and forces manual reconciliation that scales poorly in regulated environments. The practitioner conclusion is simple: governance must be continuous from entitlement decision to privileged execution.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do when legacy systems cannot support modern password controls?
A: When older systems cannot support stronger controls, teams should isolate them, wrap them with compensating controls, and limit access as much as possible. That may include separate network segmentation, VPN access, shared-account forwarding, tighter monitoring, and stronger controls around privileged users. The priority is to reduce exposure while building a path to better authentication.
👉 Read our full editorial: IAM and PAM integration in financial services: closing the governance gap