Notifications
Clear all
Topic starter
11/08/2026 3:24 pm
TL;DR: Identity investigation fails when tools stop at entitlements and miss the business context that proves whether activity is legitimate and whether access is safe to change, according to Offroad AI. The operational gap is not visibility alone, but the ability to assemble ownership, purpose, and dependency into a case that supports safe remediation.
NHIMG editorial — based on content published by Offroad AI: Identity investigation comes down to two questions, and they show up as two different jobs
Questions worth separating out
Q: How should identity teams investigate suspicious access without losing business context?
A: Start by correlating identity data with ownership, device posture, session evidence, and the work artifacts that explain why access existed.
Q: Why do access reviews miss the hardest identity cases?
A: Access reviews are snapshots, so they can confirm that access exists but not whether it is still justified, actively used, or safe to remove.
Q: What breaks when identity tools cannot identify the real owner of an account?
A: Remediation stalls because no one can confidently approve or validate the change.
Practitioner guidance
- Map the evidence sources your investigations depend on Inventory the systems that hold ownership, justification, and dependency data, then connect them to your investigation workflow so cases can pull in ticketing, HR, collaboration, and runbook evidence.
- Test investigations against real cases, not demos Use a former contractor, a bulk export, a dormant service account, and a nested-group admin path to see whether the tool can produce a clear conclusion with supporting evidence.
- Validate ownership inference for non-human identities Give the system a real service account and verify whether it can identify the owner, describe the workload, and determine if the permissions are still needed.
What's in the full article
Offroad AI's full article covers the operational detail this post intentionally leaves for the source:
- Specific evaluation prompts for testing identity investigation tools against real contractor, admin, and service account cases
- Detailed guidance on how the investigation agent reasons over identity graphs and connected context
- Operational examples of safe remediation boundaries for low-risk and high-risk access changes
- Workflow integration details for SIEM, SOAR, IGA, PAM, HR, ticketing, and collaboration systems
👉 Read Offroad AI's guide to identity investigation for IAM and NHI teams →
Identity investigation tools: what do they need beyond entitlements?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
11/08/2026 3:33 pm
Identity investigation is becoming the control plane for remediation, not a sidecar to access review. Access reviews tell you that entitlement exists, but they rarely tell you whether the activity was legitimate or whether removing the access will break a live dependency. That makes investigation the point where evidence, ownership, and change safety converge. Practitioners should treat this as a governance function, not a point product decision.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- Another finding in the same research shows that only 5.7% of organisations have full visibility into their service accounts, which helps explain why investigation and ownership resolution remain so difficult.
A question worth separating out:
Q: Who should approve automated identity changes in high-risk environments?
A: A human should approve any change that affects production, separation of duties, or customer data. Automation can handle low-risk, policy-cleared cleanup if it captures the prior state, stays within explicit bounds, and verifies the outcome. High-impact identity changes need a human gate because the cost of a wrong decision is operational, not just security-related.
👉 Read our full editorial: Identity investigation needs context to prove legitimacy and safety
