Topic starter
24/06/2026 7:44 pm
TL;DR: Discovery tools built into many PAM and IGA programmes still miss additions, removals, and permission changes between scans, leaving identity blind spots across cloud, on-premises, and hybrid estates, according to Hydden. Real-time identity visibility now sits at the centre of governance, because unmanaged accounts and stale privileges erode both control and compliance.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “The Identity System of Record”.
Key questions
Q: What fails when identity discovery only runs on a schedule?
A: Scheduled discovery fails when identity change is faster than the scan interval.
Q: Why does poor data visibility create identity governance risk?
A: Because access governance depends on knowing what the identity can reach.
Q: How do teams know whether PAM and IGA are working across the full identity estate?
A: They should test whether discovery data is fresh enough to expose newly added accounts, revoked access and privilege drift before review cycles close.
Practitioner guidance
- Make discovery continuous Move identity discovery from periodic scans to continuous collection using API queries, log parsing and event-driven capture so additions, removals and permission changes are detected close to the time they occur.
- Use discovery to seed PAM coverage Use discovered identity data to identify privileged accounts outside the standard process, then verify which of those accounts are actually vaulted, monitored and subject to session auditing.
- Rebuild access reviews on fresh identity data Prioritise certification cycles using the identities and entitlements that discovery shows are current, not the records last exported by the governance system.
Bottom line: Discovery gaps are now a governance failure mode because PAM and IGA cannot control identities they do not continuously see.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:08 am
Identity discovery is the missing control layer beneath PAM and IGA. PAM and IGA assume the identity estate is already known, but that assumption fails when accounts appear, change or disappear between scans. The result is not a tuning issue, but a structural visibility gap that weakens every downstream control depending on authoritative inventory. Practitioners should treat discovery as the prerequisite governance layer, not a supporting feature.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between attack surface discovery and access certification?
A: Attack surface discovery finds what identities, secrets and entitlements actually exist, while access certification checks whether known access should remain approved. Discovery expands the inventory, certification reviews the inventory you already have. If discovery is incomplete, certification can only validate a partial picture and may miss the identities most likely to be abused.
👉 Read our full editorial: Identity discovery is the missing layer in PAM and IGA control