Topic starter
01/07/2026 2:00 am
TL;DR: Identity governance maturity models are only meaningful when they measure how consistently access reviews, lifecycle automation, segregation of duties, and non-human identity controls operate across the enterprise, according to SecurEnds. The governance gap is no longer whether controls exist, but whether they scale across people, applications, and machine identities without relying on manual exception handling.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Identity Governance Maturity Model: How to Assess Your IGA Program”.
Key questions
Q: How should teams measure identity governance maturity across human and non-human identities?
A: Start by measuring whether access decisions are discoverable, reviewable, and revocable across the full identity lifecycle.
Q: What breaks when service accounts and workloads are left out of IGA maturity scoring?
A: The score stops measuring governance effectiveness and starts measuring only human-account process coverage.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Practitioner guidance
- Expand maturity scorecards to cover NHIs Add service accounts, workloads, APIs, certificates, and automation identities to the same maturity model used for human access governance.
- Make non-human lifecycle controls explicit Define onboarding, transfer, and offboarding triggers for machine identities, including who approves creation, who owns the credential, and how revocation is verified when the service is retired.
- Replace spreadsheet reviews with continuous certification Use automated access review workflows for non-human identities so privilege changes, dormant accounts, and unresolved exceptions are visible before the next audit cycle.
Bottom line: Identity governance maturity cannot be judged only by controls for people, because machine identities now carry material access risk across enterprise environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
01/07/2026 2:19 am
Identity governance maturity is no longer a human-only measurement: A programme that scores well on access reviews and lifecycle automation but ignores non-human identities is overstating its own control effectiveness. Service accounts, APIs, workloads, and certificates are not edge assets anymore, they are part of the core identity estate. The practitioner conclusion is simple: maturity has to be measured across all identity types or it is only partial governance.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations prioritise NHI discovery before automation?
A: Yes. Automation without discovery usually scales blind spots, because teams cannot protect what they have not found. Start by inventorying service accounts, tokens, certificates, and agent identities, then assign owners and classify privileges. Once visibility exists, automation can support rotation, revocation, and alerting instead of amplifying unknown access.
👉 Read our full editorial: Identity governance maturity now depends on non-human identities
This post was modified 5 days ago by NHI Mgmt Group