Notifications
Clear all
Topic starter
08/06/2026 4:01 pm
TL;DR: Identity governance fails when organisations rely on ad hoc processes, spreadsheets, and partial automation that cannot keep pace with access changes, according to Axiad. Manual remediation, weak provisioning oversight, and poor cross-system coordination leave users over-privileged and make compliance harder to sustain.
NHIMG editorial — based on content published by Axiad: 5 Current Challenges of Identity Governance and Administration
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when identity governance relies on spreadsheets and email approvals?
A: Access decisions lose traceability, version control, and reliable ownership.
Q: Why do inherited permissions create so much identity risk?
A: Inherited permissions are risky because they transfer trust from one identity to another without proving that the new subject needs the same access.
Q: How can security teams tell whether identity governance is working?
A: Look for evidence that approvals, recertifications, and removals are happening through a single authoritative process with clear owners and timestamps.
Practitioner guidance
- Replace ad hoc tracking with system-owned governance workflows Move access approvals, recertifications, and removals into authoritative identity workflows so the source of truth is the same place decisions are made and evidenced.
- Review privilege inheritance at onboarding Audit clone-based account creation, role templates, and delegated approvals to find where excess permissions are being passed forward by default.
- Tighten offboarding and account closure checks Verify that leaver, contractor-end, and role-change processes actually disable access, revoke linked permissions, and close dormant accounts across connected systems.
What's in the full article
Axiad's full blog covers the operational detail this post intentionally leaves for the source:
- How the vendor maps specific identity governance failure modes to practical remediation steps across access review and provisioning.
- Examples of how organisations can centralise governance without relying on ad hoc spreadsheets and manual reconciliation.
- The article's own recommended approach for improving coordination between business units, approvals, and identity data.
- The vendor's framing of adaptive governance as a response to changing access conditions across environments.
👉 Read Axiad's blog on current identity governance and administration challenges →
Identity governance and administration: where are teams still stuck?
Explore further
08/06/2026 5:24 pm
Manual identity governance is a control failure, not just an efficiency problem. When access decisions move into spreadsheets and email chains, accountability becomes fragmented and revocation becomes uncertain. That is not a tooling inconvenience, it is a governance collapse that weakens evidence, ownership, and auditability across the identity lifecycle. Practitioners should treat manual governance as an exposed control plane, not an acceptable fallback.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who is accountable when access is left active after a role change or departure?
A: Accountability should sit with the identity owner, the application owner, and the business approver chain that failed to remove or revalidate access. Governance frameworks such as NIST Cybersecurity Framework 2.0 and internal access review processes assume responsibility is explicit. If it is not, risk persists after the person leaves.
👉 Read our full editorial: Identity governance still breaks down under manual access control
