Topic starter
25/06/2026 12:55 am
TL;DR: Zero trust breaks down when permission creep, rubber-stamp reviews, and delayed offboarding leave identities overexposed, according to Omada Identity, even as cybercrime is predicted to cost the world around $10.5T in 2025. Identity governance is no longer an administrative layer; it is the control plane that keeps access verified, least privilege current, and blast radius contained.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “IGA Cybersecurity Explained: Why Identity Governance Matters Now”.
By the numbers:
- Around 40% of organisations still operate with outdated IGA.
Key questions
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Q: Why does permission creep increase breach impact?
A: Permission creep increases breach impact because compromised identities often retain access from previous roles or projects, giving attackers more paths than the current job actually requires.
Q: How do teams know if automated access reviews are actually working?
A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions.
Practitioner guidance
- Tighten access certification around role change Trigger certification when a user changes role, project, or department, not only on a calendar.
- Automate joiner-mover-leaver adjustments Remove delayed manual provisioning paths for joiners, movers, and leavers so access reflects current job status rather than legacy assignments.
- Treat stale entitlements as containment risk Prioritise cleanup of excess access on identities that can reach finance, procurement, cloud workloads, or other high-impact systems.
Bottom line: Identity governance is the practical control layer that makes zero trust enforceable across changing roles and identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:00 am
Identity governance has become the practical control plane for zero trust. Zero trust is not operational until identity decisions are current, explicit, and continuously right-sized. When access is managed through stale entitlements or ticket-driven delay, the policy model says one thing and the runtime environment does another. Practitioners should treat governance as the mechanism that keeps trust decisions coherent across the estate.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise offboarding over onboarding features?
A: They should prioritise the controls that prevent stale access from surviving role changes and departures. Onboarding efficiency matters, but the larger governance risk usually comes from access that remains usable after the business relationship has changed.
👉 Read our full editorial: Identity governance is now the control plane for zero trust