Topic starter
19/08/2026 3:24 pm
TL;DR: Nexis says identity and access governance is moving from periodic certification toward continuous, intelligence-driven control as hybrid IT, SaaS sprawl, non-human identities, and regulatory pressure make static reviews too slow for live risk and ownership changes. The governing assumption is shifting from occasional validation to continuous evidence, context, and lifecycle alignment.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “Nexis Included in the New KuppingerCole Analysts Leadership Compass for Identity and Access Governance 2026”.
Key questions
Q: What breaks when identity governance still depends on periodic certification?
A: Periodic certification breaks when identities change faster than the review cycle can capture.
Q: Why do continuous governance models matter for access risk?
A: They matter because live entitlement data, privileged access signals, and threat context produce better decisions than static snapshots.
Q: What are the signs that access governance is failing in practice?
A: The clearest signs are slow remediation, repeated rubber stamp access reviews, and missed permissions outside traditional HR linked systems.
Practitioner guidance
- Expand governance scope beyond employee access Include contractors, partners, privileged administrators, service accounts, APIs, workloads, bots, and AI agents in access review and ownership processes so governance matches the real identity estate.
- Wire live risk signals into certification workflows Ingest privileged access, SIEM, and threat detection context into review and approval flows so recertification decisions reflect current usage and current exposure rather than stale entitlement snapshots.
- Use role mining before redesigning access models Analyze observed entitlement patterns, toxic combinations, and privilege accumulation before recasting roles, because the current role design often encodes inherited sprawl that certification alone will not remove.
Bottom line: Identity governance is moving beyond batch certification because access now changes faster than periodic review can validate it.
What's in the full article
Nexis' full article covers the operational detail this post intentionally leaves for the source:
- How the NEXIS Platform uses an identity access graph to support impact analysis and authorization modelling
- How NICO guides approvers, reviewers, and business users through AI-assisted governance workflows
- How Segregation of Duties checks are embedded into access requests, role creation, and certification campaigns
- How ISPM adds continuous detection and remediation into the identity governance workflow
👉 Read Nexis' analysis of continuous intelligence in identity access governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:09 pm
Continuous intelligence is becoming the default governance model for identity programmes. Periodic certification was built for a slower environment where access states changed infrequently enough to be reviewed in batches. That assumption is failing as SaaS sprawl, hybrid infrastructure, and delegated access patterns create constant entitlement drift. The practical conclusion is that governance has to observe access as it changes, not only after the fact.
A question worth separating out:
Q: Why do NHIs complicate zero trust and least privilege efforts?
A: NHIs complicate zero trust because they are numerous, persistent, and often tightly integrated into applications and pipelines. If teams cannot see every identity or keep permissions aligned to actual usage, they cannot consistently prove least privilege. Continuous review and revocation are essential, not optional.
👉 Read our full editorial: Identity access governance is shifting to continuous intelligence