Topic starter
16/09/2026 9:21 am
TL;DR: Identity investigations often stall because ownership, entitlement scope, and recent change history must be assembled manually across disconnected systems, and Hydden argues that this hidden work can stretch response times to a day and a half while regulated filings demand answers in hours. The real gap is assumed coverage, not logging volume: identity recordkeeping has to be continuous, queryable, and available where analysts already work.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “Why One Identity Question Takes Two Days to Answer”.
Key questions
Q: What breaks when identity coverage is assumed rather than continuously recorded?
A: When coverage is assumed, teams can see individual systems but cannot answer identity questions without manual reconstruction.
Q: Why do identity incidents create both operational and compliance pressure at the same time?
A: Because the same actions that restore access can also create regulatory and audit exposure if they are not attributable and defensible.
Q: How can teams tell whether identity investigations are under control?
A: They should measure how often basic account questions are answered by lookup versus manual coordination.
Practitioner guidance
- Build a queryable identity system of record Capture ownership, purpose, entitlements, and review dates in one place so analysts can answer account questions without chasing multiple teams.
- Track access changes continuously Record changes as they happen rather than relying on periodic snapshots, so prior-state questions can be answered during investigations and reviews.
- Resolve service account accountability Assign a named business or technical owner for every service account and keep that owner visible in the same workflow used by incident responders and auditors.
Bottom line: Identity investigations stall when the record behind an account has to be assembled from several systems instead of queried directly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/09/2026 9:21 am
Assumed identity coverage is a governance failure, not a visibility slogan. The article shows that teams often believe identity is covered because directories, tools, and reviews exist somewhere in the stack. In practice, coverage only exists when ownership, scope, and change history are available together at the point of need. Practitioners should treat the absence of a queryable identity record as an operating risk, not a reporting inconvenience.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams prioritise identity recordkeeping or more logging?
A: Identity recordkeeping should come first when the question is about who owns access, what that access can reach, or what changed. Logging remains useful for activity, but it does not replace the access-state facts that investigations, audits, and incident reporting depend on.
👉 Read our full editorial: Assumed identity coverage leaves investigations and reporting behind