Topic starter
24/06/2026 11:26 pm
TL;DR: 95% of leaders now treat identity security as a critical part of cyber strategy, while more than 86% worry about identity-based threats and many still struggle with manual, high-TCO IGA, according to Omada Identity’s 2025 State of Identity Governance Report. Identity governance is moving from administration to board-level cyber control because the operating model is still too slow for cloud and compliance pressure.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “86 Prozent aller IT-Entscheider fürchten Bedrohungen der Identitätssicherheit”.
By the numbers:
- 95% of leaders now treat identity security as a critical component of their overall cybersecurity strategy.
- More than 86% of leaders express concern about the risks of identity-based threats.
- More than 500 IT and business executives took part in the survey behind the report.
Key questions
Q: What breaks when identity governance still relies on manual approvals and rule maintenance at scale?
A: Manual governance increases error, slows access decisions, and raises the chance that users receive inappropriate or delayed access.
Q: Why do outdated identity governance processes increase cyber risk in cloud environments?
A: Outdated identity governance usually leaves access decisions too slow, too manual, and too broad for cloud operations.
Q: How do security teams know if business-driven IGA is working?
A: Look for falling revocation latency, fewer orphaned accounts, fewer unused entitlements, and faster completion of access changes after joins, moves, and exits.
Practitioner guidance
- Audit governance latency across critical access workflows Measure how long it takes to approve, certify, or revoke access in the systems that matter most.
- Prioritise cloud and SaaS entitlements for automation Move recurring certification, leaver handling, and policy enforcement away from spreadsheet-driven reviews where entitlements change frequently.
- Reassess IGA total cost of ownership against control coverage Compare tooling spend with the coverage actually delivered across hybrid estates, including visibility, review cadence, and removal speed.
Bottom line: Identity governance has moved into the cyber strategy layer because access decisions now influence breach risk, compliance, and operational resilience.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:18 am
Identity governance is now a board-level cyber control, not an administrative back office function. The report shows that executives increasingly link identity security to overall cyber strategy because access decisions now shape breach risk, auditability, and operational resilience. That elevates identity governance from process efficiency to governance accountability. Practitioners should expect stronger scrutiny of how quickly access is approved, reviewed, and removed.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What is the difference between access management and identity governance?
A: Access management controls how access is granted and used at runtime, while identity governance decides whether that access should continue to exist. The two functions become much stronger when connected, because usage data can inform governance actions. Without that connection, teams often review stale entitlements without knowing whether they were ever used.
👉 Read our full editorial: Identity governance is now a board-level cyber control in 2025