Topic starter
22/06/2026 1:43 pm
TL;DR: Many organisations still cannot answer basic questions about who has access to what, leaving outdated permissions, forgotten accounts, and unauthorized admin rights to accumulate beneath PAM and IGA investments, according to SPHERE's Q&A with Rita Gurevich. Zero Trust cannot function as intended until identity governance restores visibility and accountability to access.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “SHARED INTEL Q&A: Inside the access mess no one sees — and the identity risk no one owns”.
Key questions
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Q: Why do PAM and IGA tools still leave access blind spots?
A: Because tools do not create ownership.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Define a single access ownership model Assign explicit ownership for every access decision, including approval, review, and revocation, so no entitlement sits between IAM, security, and application teams without accountability.
- Inventory dormant and outdated privileges Review privileged entitlements, forgotten accounts, and stale administrative rights across directories, cloud services, and applications, then tie exceptions to named owners.
- Make recertification operational, not ceremonial Use access reviews to force business owners to validate whether current access still matches role and need, rather than merely acknowledging a checklist.
Bottom line: The article's central warning is that access visibility and ownership are still incomplete in many organisations, even where PAM and IGA are already deployed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 1:49 pm
Identity governance is the control plane Zero Trust cannot function without. Zero Trust assumes continuous, meaningful verification, but verification has little value when the organisation cannot state who should have access in the first place. The governance layer defines the baseline that authentication, authorization, and privilege checks are supposed to enforce. Without it, Zero Trust becomes an enforcement shell around stale entitlements and unclear accountability.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 49% of IT professionals would prioritise improving privileged access management if the decision were theirs alone, according to Netwrix's 2023 Hybrid Security Trends Report.
A question worth separating out:
Q: When should organisations prioritise zero-trust controls in privileged access programmes?
A: Organisations should prioritise zero-trust controls when they operate across cloud, on-premises, and third-party systems, or when privileged access is shared across multiple teams. Zero trust is most valuable when access needs to be continuously verified rather than assumed. In practice, it helps reduce standing privilege, improve segmentation, and make privilege decisions easier to audit.
👉 Read our full editorial: Identity governance gaps are exposing the limits of zero trust