Notifications
Clear all
Topic starter
19/08/2026 3:24 pm
TL;DR: Identity and access governance is moving from periodic certification toward continuous, intelligence-driven control, according to Nexis, as organisations contend with hybrid IT, SaaS sprawl, non-human identities, and rising regulatory pressure. The governance problem is no longer just access review cadence; it is keeping entitlement decisions aligned with live risk, ownership, and lifecycle change.
NHIMG editorial — based on content published by Nexis: included in the KuppingerCole Analysts Leadership Compass for Identity and Access Governance 2026
By the numbers:
- In modern enterprises, NHIs outnumber human identities by 25x to 50x, which changes the scale of governance work.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
Questions worth separating out
Q: How should security teams run access reviews for non-human identities?
A: Security teams should scope reviews by risk pattern, assign every identity to an accountable owner, and require a documented decision for each item in scope.
Q: Why do periodic certification campaigns fall short for modern identity governance?
A: Periodic campaigns assume access is stable long enough to be reviewed on a schedule, but modern environments change continuously across SaaS and machine identities.
Q: What do teams get wrong about data access governance?
A: They often treat access review as a directory exercise instead of a data-risk exercise.
Practitioner guidance
- Expand governance scope to non-human identities Map service accounts, APIs, workloads, bots, and AI agents into the same governance inventory as human users so recertification does not miss the majority of access-bearing identities.
- Move from snapshot reviews to relationship-based decisions Model identities, entitlements, roles, and ownership as connected relationships so reviewers can see toxic combinations, inherited access, and orphaned entitlements before approval.
- Fuse governance with live risk signals Feed privileged access, SIEM, and threat detection telemetry into governance workflows so elevated or suspicious access is reviewed in context.
What's in the full article
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- The specific capabilities of the NEXIS Platform across identity analytics, role mining, and authorization modelling.
- How the identity access graph supports impact analysis and governance simulation before production changes.
- What NICO does inside review, approval, and certification workflows to explain recommendations.
- How ISPM and segregation-of-duties checks are embedded into access request and certification processes.
👉 Read Nexis's analysis of identity access governance in the 2026 Leadership Compass →
Identity access governance is becoming continuous. What changes now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
19/08/2026 4:09 pm
Identity access governance is becoming a continuous control plane, not a periodic review activity. Quarterly certification cycles were designed for environments where access changed slowly and human approvers could validate context manually. That model breaks down when entitlements move across SaaS, workloads, service accounts, and AI-enabled workflows faster than review windows can capture. Practitioners should read this as a shift in control philosophy, not just tooling.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: How should organisations decide whether to invest in IGA analytics or more review automation?
A: They should start with the review failure they need to fix. If the problem is weak visibility, prioritise identity and entitlement relationship data. If the problem is review fatigue, add contextual scoring and workflow automation. The best programmes use analytics to improve decisions and automation to reduce repeat manual effort.
👉 Read our full editorial: Identity access governance is shifting to continuous intelligence
