Topic starter
10/07/2026 9:21 pm
TL;DR: Identity remains the most common attack surface in incident response, and the article argues that granular, identity-based access controls depend on visibility, context, and enforcement across users, machines, applications, and AI agents, according to Zero Networks. The practical lesson is that least privilege is not a policy statement; it fails when organisations cannot see, scope, and continuously verify reachability.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “Ask the Expert: A Field CTO’s Guide to Identity Security, Access Controls, and Zero Trust”.
By the numbers:
- 99% of cloud users, roles and services hold excessive permissions, according to Zero Networks.
- Some cloud users, roles and services go unused for 60 days or more, according to Zero Networks.
Key questions
Q: What breaks when identity-based access controls do not have live visibility?
A: Without live visibility, teams cannot tell which identities should still be allowed to reach which assets, so least privilege becomes a static claim rather than a working control.
Q: Why do excessive permissions create so much risk in Zero Trust programmes?
A: Excessive permissions expand the number of paths an attacker can use after the first compromise.
Q: What are the signs that identity governance is failing at the network layer?
A: Common signs include unclear communication flows, broad access that remains unused for long periods, and teams that cannot explain why a user, workload or agent can still reach a given service.
Practitioner guidance
- Map real communication paths Inventory which users, workloads, applications and AI agents actually talk to each other before trying to authorise them by role alone.
- Tie policy to live identity context Use observed identity context to decide whether a connection should be allowed, rather than relying only on static group membership or entitlement records.
- Reduce excessive permissions first Prioritise identities with broad, unused or stale reachability, because those are the paths most likely to bypass least privilege in practice.
Bottom line: The article's central problem is not whether identity-based access control exists, but whether visibility and enforcement are strong enough to make it real in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:43 pm
Identity-based access control is only as strong as the organisation's ability to observe live reachability. The article correctly shifts the discussion away from policy language and toward enforcement conditions. If security teams cannot see current communication paths across users, machines, applications and agents, least privilege remains an assertion rather than a control. That makes visibility the precondition for any credible identity-first architecture.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
👉 Read our full editorial: Identity-based access controls still fail without visibility and enforcement