Topic starter
27/06/2026 1:02 pm
TL;DR: Nexis reports that identity governance is shifting from an operational task to an enterprise security, risk, and compliance control plane, as Gartner’s summit discussions and market outlook point to fragmented visibility, siloed intelligence, and slow remediation as the main blockers. The real gap is not tools alone but the inability to turn identity data into timely, auditable action.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “From IGA Complexity to IVIP”.
Key questions
Q: How can IAM teams bring machine identities into lifecycle governance?
A: Apply the same lifecycle discipline used for human access to service accounts, tokens, cloud services, and AI-connected identities.
Q: Why does fragmented visibility make identity incidents harder to contain?
A: Identity incidents often begin in one system and finish in another.
Q: What do organisations get wrong about recertification cycles?
A: They often treat recertification as a compliance event instead of a control outcome.
Practitioner guidance
- Inventory all identity types Build one inventory that includes humans, service accounts, workloads, APIs, and agentic identities, then map each to owners and business context.
- Separate visibility from intelligence Define which team owns identity discovery, which team enriches risk context, and which team can trigger remediation so the process does not collapse into manual review.
- Prioritise correlated remediation Use identity and security signals together to rank entitlements, access paths, and anomalous usage before recertification begins.
Bottom line: Identity governance is moving into the security control plane because modern estates include far more than human users.
What's in the full article
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- How Nexis maps identity visibility, intelligence, and governance into a single platform view
- The practical detail behind real-time segregation of duties enforcement and explainable recertification
- How continuous identity security posture management connects identity data to GRC objectives
- The article’s discussion of enterprise and third-party risk management features tied to identity context
👉 Read Nexis's analysis of identity governance as an enterprise security control plane →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:11 pm
Identity governance is becoming a security control plane because identity risk is now distributed across every identity type. The old assumption was that governance mainly managed human access in stable directory structures. That assumption no longer holds when service accounts, workloads, APIs, and agentic systems can all create security exposure. Practitioners should now treat identity governance as infrastructure for risk reduction, not as an after-the-fact compliance routine.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What is the difference between access management and identity governance?
A: Access management controls how access is granted and used at runtime, while identity governance decides whether that access should continue to exist. The two functions become much stronger when connected, because usage data can inform governance actions. Without that connection, teams often review stale entitlements without knowing whether they were ever used.
👉 Read our full editorial: Identity governance is becoming an enterprise security control plane