Notifications
Clear all
Topic starter
25/06/2026 3:03 pm
TL;DR: Access creep, orphaned accounts, and untracked admin rights show why identity governance and administration has become essential for enforcing least privilege, proving access decisions, and reducing audit and breach risk, according to SecurEnds. The core issue is that access reviews and offboarding still lag the speed and scale of modern identity sprawl, leaving control gaps that matter across IAM, NHI, and lifecycle governance.
NHIMG editorial — based on content published by SecurEnds: why identity governance and administration is important
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should organisations implement identity governance and administration across cloud apps?
A: Start with a consolidated entitlement inventory, then define access policies by role, risk, and system sensitivity.
Q: Why do orphaned accounts create so much governance risk?
A: Orphaned accounts are risky because they preserve access after the business reason for that access has ended.
Q: What breaks when access reviews are manual and inconsistent?
A: Manual reviews tend to miss stale entitlements, duplicate access, and hidden privileged roles because reviewers lack a complete, current view of access.
Practitioner guidance
- Inventory entitlements across every identity source Build a single entitlement map across directories, SaaS applications, cloud roles, and privileged accounts so reviewers can see actual access rather than app-by-app fragments.
- Automate mover and leaver revocation Connect HR and identity events to access removal so role changes and exits trigger entitlement cleanup, credential revocation, and confirmation that dependent access was removed.
- Tighten recertification around high-risk access Prioritise privileged roles, sensitive-data applications, and stale service accounts for more frequent review, and require named approvers to confirm business need.
What's in the full article
SecurEnds's full article covers the operational detail this post intentionally leaves for the source:
- How the article maps IGA benefits to compliance, IT efficiency, and cost reduction in practice
- The vendor's own examples of provisioning, offboarding, and access review workflows
- Additional context on how IGA supports cloud and SaaS growth across hybrid environments
- The article's full list of business benefits for stakeholders who need implementation detail
👉 Read SecurEnds's article on why identity governance and administration matters →
Identity governance and administration: what gaps are teams missing?
Explore further
25/06/2026 4:20 pm
IGA is now the control plane for identity sprawl, not a back-office admin tool. The article is right to frame access sprawl, orphaned accounts, and untracked admin rights as everyday conditions rather than edge cases. Once organisations run dozens of apps across cloud and on-prem environments, identity governance becomes the only practical way to keep entitlement drift visible. That makes IGA a foundational control for human access, privileged roles, and non-human identities alike. The practitioner conclusion is simple: if you cannot govern access centrally, you do not really know your exposure.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how weak identity observability still is in practice.
A question worth separating out:
Q: Who is accountable when access remains after someone leaves?
A: Accountability should sit with the identity governance process owner, the application owner, and the business manager who approved access in the first place. If access remains after exit, the failure is usually procedural, not technical. A sound programme makes removal mandatory, traceable, and verifiable before the identity is considered closed.
👉 Read our full editorial: Identity governance and administration is closing access sprawl
