Topic starter
25/06/2026 3:04 pm
TL;DR: Legacy IGA models struggle with deepfake-enabled fraud, privilege drift, machine identity sprawl, and fragmented audit evidence across hybrid environments, according to SafePaaS. Static roles and manual reviews no longer match the speed or shape of modern identity risk, so governance now has to be continuous, contextual, and operational.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “Risk-Based Identity Governance Strategies for CISOs”.
By the numbers:
- More than 60% of breaches now result from compromised credentials via phishing, brute force, or privilege abuse.
- The Identity Defined Security Alliance reports that 94% of organizations have suffered a breach in the last two years.
Key questions
Q: What breaks when identity governance is built without strong role foundations?
A: Reviews become repetitive exceptions management, because certifiers have no stable baseline for what access should exist.
Q: Why do machine identities increase outage risk in hybrid environments?
A: Hybrid environments multiply certificates, secrets, and keys across clouds and platforms, so expiry or misconfiguration in one place can interrupt dependent services elsewhere.
Q: How should security teams govern privileged access in cloud and hybrid environments?
A: Teams should govern privileged access around runtime authorization, not just connectivity or login.
Practitioner guidance
- Unify identity evidence across the lifecycle Consolidate access reviews, approvals, exceptions, and remediation records into one governance trail so audit, response, and certification use the same source of truth.
- Extend governance to machine identities Inventory service accounts, application credentials, and other non-human identities alongside human accounts, then include them in lifecycle ownership and review processes.
- Replace static role decisions with policy-based controls Use contextual access decisions for high-risk applications and admin paths so business events, security signals, and privilege changes can influence access in real time.
Bottom line: Legacy IGA breaks down when access changes faster than review cycles and when evidence is scattered across disconnected tools.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:22 pm
Risk-based identity governance is becoming the operating model for hybrid enterprises. The article shows why periodic access reviews and static role models no longer match how identity risk behaves across cloud, SaaS, and on-premises systems. When privileges drift faster than governance cycles, the control plane has to become continuous, contextual, and tied to real security signals.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams measure whether identity governance is actually reducing risk?
A: Measure outcomes that reflect attacker friction, not policy activity. Focus on revocation speed, stale account reduction, identity telemetry coverage, and the percentage of privileged access that is still standing outside an approved business purpose. If those indicators do not improve, the programme may look mature but still leave exploitable access paths in place.
👉 Read our full editorial: Risk-based identity governance for CISOs in hybrid enterprise