Topic starter
11/07/2026 2:03 pm
TL;DR: Privileged access carries a larger blast radius than routine app access, according to Soffid. PAM needs stricter review and revocation so standing privilege does not hide in ordinary access workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Soffid: “What Is IAM? IAM vs IGA vs PAM Explained”.
Key questions
Q: Why does privileged access need separate governance from ordinary app access?
A: Privileged access carries a larger blast radius, so the review and revocation threshold must be stricter than for standard application access.
Q: How should security teams measure whether IGA is reducing risk?
A: Measure whether access is becoming safer, faster, and less manual.
Q: What breaks when organisations treat IGA and PAM as the same control?
A: They lose sight of two different risks at once.
Practitioner guidance
- Separate IAM, IGA and PAM ownership Assign distinct process owners for authentication and access, lifecycle certification, and privileged oversight so each control has clear evidence and escalation paths.
- Review privileged access as a separate population Create a dedicated review cycle for administrative users and service accounts instead of folding them into standard user recertification.
- Automate recertification on role and lifecycle change Trigger access certification when roles change, contracts end, or accounts are modified so standing access does not persist by default.
Bottom line: IAM, IGA and PAM are distinct control layers, and treating them as one programme blurs accountability for access, certification and privilege.
Glossary terms: Identity And Access Management, Identity Governance and Administration (IGA), Privilege Access Management, Least Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
11/07/2026 2:12 pm
Identity governance fails when access, lifecycle and elevation are treated as one control plane: the article is right to separate IAM, IGA and PAM because each answers a different governance question. IAM is about access verification, IGA is about whether access should continue, and PAM is about what happens when access becomes high-risk. Practitioners should use that separation to avoid audit blind spots and control overlap.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between access control and access accountability in PAM?
A: Access control decides whether an identity may connect to a protected system, while access accountability proves what the identity did after connection. PAM programmes need both. A system can be tightly authorised and still be ungovernable if it cannot produce session-level evidence, identity context, and retained records for review.
👉 Read our full editorial: IAM, IGA and PAM: where identity governance meets privileged access