Notifications
Clear all
Topic starter
24/06/2026 7:45 pm
TL;DR: Fortune 500 IAM leaders say fragmented identity data, manual certification work, and services-heavy deployments are overwhelming programmes and leaving controls partially implemented, according to Hydden. The deeper problem is that governance models still assume clean, centralised identity data and sustainable manual oversight, even as AI and regulatory pressure increase.
NHIMG editorial — based on content published by Hydden: the case for a new foundation in identity management
Questions worth separating out
Q: Where do IAM programmes fail when identity data is fragmented across many systems?
A: They fail where review, provisioning, and audit decisions depend on inconsistent identity state.
Q: When should organisations stop treating manual IAM work as acceptable?
A: They should stop when manual work becomes the default mechanism for validating entitlements, reconciling records, or approving access.
Q: What do security teams get wrong about IAM platform consolidation?
A: They often assume more catalog breadth means better governance.
Practitioner guidance
- Map the authoritative identity record Document which system owns each identity attribute, entitlement, and status field across HRIS, directory, cloud, SaaS, and PAM sources.
- Measure manual reconciliation effort Track how many certification, provisioning, and audit tasks still rely on spreadsheet exports, email approvals, or contractor cleanup.
- Test control ownership without external services Ask whether the internal team can run, modify, and recover the IAM control without a consultant on call.
What's in the full article
Hydden's full article covers the operational detail this post intentionally leaves for the source:
- Specific examples of how identity data fragmentation shows up across enterprise systems and why it slows governance.
- The vendor's explanation of why manual IAM processes keep reappearing even after platform investments.
- A deeper account of the services dependency cycle and how it affects deployment economics.
- The article's rationale for a different identity-data-first operating model.
👉 Read Hydden's analysis of fragmented identity data and manual IAM operations →
Identity data fragmentation and manual IAM: what teams are missing?
Explore further
25/06/2026 5:11 am
Identity fragmentation is now a control problem, not a data-quality nuisance. When identity state is split across directory services, HR systems, clouds, and SaaS platforms, every review, attestation, and provisioning decision starts from disagreement. That means the programme is governing access against conflicting evidence instead of a single source of truth. The implication is straightforward: identity governance cannot be mature while identity data remains operationally fragmented.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
A question worth separating out:
Q: How do you know if an IAM control is actually sustainable?
A: A control is sustainable only if the internal team can operate, update, and recover it without depending on external specialists for routine changes. If configuration knowledge lives mainly with consultants, the control is fragile. Sustainability shows up in repeatable ownership, not in the size of the deployment project.
👉 Read our full editorial: Identity data fragmentation is straining enterprise IAM programmes
