Topic starter
10/06/2026 11:32 pm
TL;DR: Fragmented identity tooling creates blind spots, weak audit evidence, and delayed incident response because access data, approvals, and logs live in separate systems, according to Cerbos’s discussion with 1Kosmos advisor Giao Nguyen. Continuous governance matters because IAM maturity is no longer about how many tools you have, but whether you can prove and enforce access decisions in real time.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Overcoming IAM blind spots and fragmentation for continuous governance”.
Key questions
Q: What breaks when IAM data is spread across too many systems?
A: The control chain breaks because no one can reliably connect approvals, entitlements, and logs into one auditable access decision.
Q: Why does fragmented IAM increase operational and security risk?
A: Fragmented IAM increases risk because access data, review states, and revocation actions diverge across tools.
Q: What are the signs that governance controls are not working as intended?
A: Common signs include slow remediation of governance deficiencies, inconsistent policy enforcement, weak communication between business and IT, and controls that do not surface non-compliance early enough.
Practitioner guidance
- Inventory every identity source Catalog HR systems, directories, cloud consoles, governance tools, and any shadow identity stores so you know where access truth currently lives.
- Unify access evidence Create a single reporting layer that can answer who approved access, when it changed, and why the entitlement still exists.
- Externalise policy decisions Move recurring access rules into policy-as-code so applications enforce the same approval logic instead of maintaining local exceptions.
Bottom line: Identity sprawl weakens IAM because the organisation can no longer prove access decisions from request to enforcement to audit evidence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 5:42 am
Identity sprawl is a governance failure before it is a tooling problem. When approvals, entitlements, and logs sit in separate systems, the organisation loses the ability to prove access decisions end to end. That breaks continuous governance because control depends on a single operational view, not a stack of disconnected products. The practitioner conclusion is that governance maturity starts with identity data coherence, not more console coverage.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to the State of Secrets in AppSec.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How can teams move from periodic IAM reviews to continuous control?
A: By combining contextual enforcement, automated revocation, and runtime detection instead of relying on annual or quarterly certification alone. The goal is to make access decisions responsive to behaviour, device state, and current risk, so that high-risk access can be challenged or removed before it is abused.
👉 Read our full editorial: Identity sprawl is undermining continuous governance across IAM
This post was modified 5 days ago by NHI Mgmt Group