Topic starter
10/06/2026 11:33 pm
TL;DR: Identity and access management failures are increasingly tied to personal CISO exposure, with over half fearing they could be fired after a breach and 40% worrying about personal liability, according to Cerbos. The real issue is not tooling presence but fragmented governance, weak identity proofing, and controls that do not produce reliable accountability.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “When breach becomes personal. CISOs, identity failures and the road to continuous governance”.
Key questions
A: Security teams should separate identity proofing from authentication and apply stronger checks only where risk justifies it.
Q: Why do multiple IAM tools make accountability harder?
A: Multiple tools often mean multiple partial records, which makes it hard to prove who approved access, where it was used, and whether governance decisions were consistent.
Q: What signals show that IAM governance is failing?
A: Common signals include conflicting identity records, incomplete access histories, slow termination workflows, and reviewers who cannot explain why privileges still exist.
Practitioner guidance
- Tighten joiner identity proofing Require stronger verification for new hires and contractors, especially in remote onboarding flows where synthetic identities can slip through document-only checks.
- Unify identity data sources Create a governed identity record that reconciles HR, SSO, PAM, and application access data so reviews and investigations do not rely on conflicting systems.
- Log authorisation decisions centrally Make access approval, denial, and policy-evaluation events searchable so the organisation can reconstruct why access was granted at the time.
Bottom line: IAM failures are now judged as leadership failures as well as security failures, which increases the importance of evidence-rich governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 5:47 am
Accountability debt is now part of IAM design: When identity governance cannot explain who had access, who approved it, and why it persisted, the security leader inherits the blame even if the failure was distributed across HR, IT, and application teams. That changes IAM from a control problem into a governance proof problem. Practitioners should treat defensible evidence as a first-class requirement, not an afterthought.
A question worth separating out:
Q: Why does policy-based access control improve auditability?
A: Because the decision logic is written and managed as a governed policy rather than spread across applications and tickets. Auditors can inspect the rule, the change history, and the decision trace. That only works if the organisation logs policy inputs and preserves accountability for each change.
👉 Read our full editorial: Identity failures are making CISO accountability a personal risk
This post was modified 5 days ago by NHI Mgmt Group