Notifications
Clear all
Topic starter
11/07/2026 8:35 pm
TL;DR: A Zscaler study cited in the article says 96% of IT leaders believe their security is strong even as serious attacks keep rising, underscoring a persistent gap between perception and control maturity. The practical issue is not tooling volume, but whether identity, privileged access, and recertification actually constrain real attack paths.
NHIMG editorial — based on content published by Soffid: Ciberseguridad en las empresas: 4 retos críticos de IAM y cómo resolverlos de manera sencilla
By the numbers:
- 96% of the encargados de TI considera que la seguridad en sus empresas es robusta, sin embargo, el número de ataques graves sigue creciendo.
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams reduce enterprise risk with IAM, IGA, and PAM together?
A: Security teams should treat IAM, IGA, and PAM as one governance system, not separate projects.
Q: Why do SSO and MFA not solve identity risk on their own?
A: SSO and MFA reduce credential abuse, but they do not decide whether a user or account should have access after authentication.
Q: What breaks when privileged access is not governed separately?
A: When privileged access is treated like ordinary access, the organisation loses control over blast radius.
Practitioner guidance
- Unify identity sources and entitlement records Create one authoritative view of users, service accounts, third parties, and privileged identities so access can be reviewed against the same data set across IAM, IGA, and PAM.
- Separate privileged access from standard access Treat elevated accounts as a distinct governance class with time-bounded access, stronger audit requirements, and explicit approval and revocation steps.
- Tie recertification to live business need Run access reviews against current role, project, and vendor relationship data so dormant permissions are removed when the business context changes.
What's in the full article
Soffid's full article covers the operational detail this post intentionally leaves for the source:
- A fuller walkthrough of how the platform positions IAM, IGA, SSO, MFA, ITDR, and PAM as a single operating model.
- The specific way Soffid describes access unification across cloud and on-premise environments.
- More detail on recertification, privileged access handling, and continuous validation in day-to-day administration.
- The vendor's explanation of how it frames identity simplification for enterprise security teams.
👉 Read Soffid's article on four enterprise IAM challenges and how it frames them →
IAM governance gaps in enterprises: what practitioners need to know?
Explore further
11/07/2026 9:03 pm
Identity governance is now the control plane for enterprise cyber risk. The article correctly groups IAM, IGA, MFA, SSO, and PAM because attackers do not respect organisational silos. When access is fragmented, governance becomes inconsistent, and the attacker only needs one weak identity path to expand further. The practitioner conclusion is straightforward: if identity is not unified, security is not enforceable.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Another finding shows that 97% of NHIs carry excessive privileges, which broadens attack surface and complicates containment.
A question worth separating out:
Q: How do organisations know whether access review is actually working?
A: Access review is working only when it removes unused permissions, clears stale entitlements, and produces evidence that access matches current business need. If reviews only create paperwork, they are not reducing risk. The useful signal is whether revoked access stays revoked across systems, vendors, and privileged workflows.
👉 Read our full editorial: Enterprise IAM gaps persist as attacks outpace security confidence
