Notifications
Clear all
Topic starter
17/08/2026 4:38 pm
TL;DR: Identity has become the cloud perimeter, but most organisations still govern access with fragmented reviews, siloed visibility, and manual decisions that leave excessive entitlement and stale access in place, according to Clarity Security. The real control gap is not authentication at the door but governance after entry, where blast radius expands unchecked.
NHIMG editorial — based on content published by Clarity Security: identity is the new perimeter, but governance is the firewall
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.
Questions worth separating out
Q: How should teams govern access after authentication succeeds?
A: Teams should govern post-authentication access as an active lifecycle problem, not a one-time approval record.
Q: Why do stale accounts and unused groups increase cloud risk?
A: Stale accounts and unused groups widen the blast radius because they preserve reachable access paths that no longer match current job duties or system needs.
Q: What do security teams get wrong about access reviews?
A: Teams often treat access reviews as proof of control, when they are really only a point-in-time check.
Practitioner guidance
- Map identity blast radius by entitlement depth Inventory who can reach what after authentication, then rank identities by the scope of their standing access rather than by login method.
- Rebuild access reviews around ownership and usage Require each entitlement to have a named owner and a current usage signal before review approval.
- Eliminate stale access before it becomes normalised Prioritise dormant accounts, unused groups, and long-lived service credentials for removal or re-certification.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor frames identity governance as a control-plane problem across cloud access.
- The access review workflow concepts behind context-based entitlement decisions.
- The practical distinctions between siloed visibility, ownership, and review coverage.
- The product context behind the platform positioning, which this analysis deliberately does not evaluate.
👉 Read Clarity Security's analysis of identity governance as the cloud firewall →
Identity governance is the firewall teams are still not closing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
Governance is the firewall, not an admin convenience layer. The article is right to separate authentication from access governance because the risk starts after the front door opens. In mature programmes, review, ownership, and expiry are what keep identity from becoming an uncontrolled perimeter. For IAM and IGA teams, the practical conclusion is that governance coverage must be treated as a core control surface, not an afterthought.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, which means the governance model is already lagging operational reality.
A question worth separating out:
Q: Who should own identity governance when it spans cloud and enterprise systems?
A: Ownership should sit with the identity governance team, but implementation must be shared with application, cloud, and platform owners because the access data lives in their systems. If accountability stays central while operational control stays fragmented, certifications and exception handling will lag.
👉 Read our full editorial: Identity governance is the firewall cloud programs keep leaving open
