Topic starter
25/06/2026 12:55 am
TL;DR: Access stays overexposed when permission creep, rubber-stamp reviews, and delayed offboarding outpace governance, according to Omada Identity. Identity governance has to keep entitlement data current so zero trust can contain blast radius and verify least privilege.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “IGA Cybersecurity Explained: Why Identity Governance Matters Now”.
By the numbers:
- Around 40% of organisations still operate with outdated IGA.
Key questions
Q: Why does permission creep increase breach impact?
A: Permission creep increases breach impact because compromised identities often retain access from previous roles or projects, giving attackers more paths than the current job actually requires.
Q: How do teams know if automated access reviews are actually working?
A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions.
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Practitioner guidance
- Tighten access certification around role change Trigger certification when a user changes role, project, or department, not only on a calendar.
- Automate joiner-mover-leaver adjustments Remove delayed manual provisioning paths for joiners, movers, and leavers so access reflects current job status rather than legacy assignments.
- Treat stale entitlements as containment risk Prioritise cleanup of excess access on identities that can reach finance, procurement, cloud workloads, or other high-impact systems.
Bottom line: Identity governance is the practical control layer that makes zero trust enforceable across changing roles and identities.
Glossary terms: Identity Governance and Administration (IGA), Permission Creep, Blast Radius, Rubber-stamp Review
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/06/2026 10:00 am
Identity governance has become the practical control plane for zero trust. Zero trust is not operational until identity decisions are current, explicit, and continuously right-sized. When access is managed through stale entitlements or ticket-driven delay, the policy model says one thing and the runtime environment does another. Practitioners should treat governance as the mechanism that keeps trust decisions coherent across the estate.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise offboarding over onboarding features?
A: They should prioritise the controls that prevent stale access from surviving role changes and departures. Onboarding efficiency matters, but the larger governance risk usually comes from access that remains usable after the business relationship has changed.
👉 Read our full editorial: Why identity governance must anchor zero trust enforcement
This post was modified 17 hours ago by NHI Mgmt Group