Topic starter
24/06/2026 9:19 pm
TL;DR: Identity management still hinges on the split between claimed identity and actual identity, and weak authentication or over-broad authorization leaves organisations exposed to phishing, credential theft, and breach spread, according to 1Kosmos. The real problem is that many IAM programmes still treat identity proofing, access control, and zero trust as adjacent tasks instead of one lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What Is Identity Management?”.
Key questions
Q: What breaks when identity platforms stop at authentication for non-human identities?
A: Authentication-only control breaks when the platform can confirm that an NHI logged in but cannot govern what that identity can do afterward.
Q: Why do stolen credentials become so damaging in weak IAM models?
A: They become damaging because the identity is treated as trusted once it clears login, even when the access scope is too broad.
Q: How can organisations tell if identity proofing is too weak?
A: Look for repeated reliance on one-time checks, inconsistent approvals, and recovery actions that are accepted without strong context.
Practitioner guidance
- Harden identity proofing before login Require stronger evidence of actual identity for high-risk access so a stolen credential cannot pass as a legitimate person or process.
- Tighten authorization after successful authentication Map every authenticated role to the minimum resource set needed for the task and remove broad standing access that turns one login into broad system reach.
- Re-authorize at meaningful access points Do not treat initial authentication as sufficient for the rest of the session.
Bottom line: The core failure is the gap between proving a claim and constraining what that claim can do after login.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:29 am
The authentication boundary is still the point where identity programmes fail first. Organisations often harden login while leaving downstream access assumptions untouched, so a successful authentication event becomes a pass into too much privilege. The result is not just weaker security, but a governance model that treats identity proof, access scope and re-validation as separate problems. Practitioners should read this as a lifecycle failure, not a single control failure.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: The practical approach is to add identity assurance before login and use passwordless or self-service recovery where the application allows it. That preserves a smoother user experience while raising confidence in who is requesting access. For systems that still require passwords, organisations should pair them with stronger reset and verification steps.
👉 Read our full editorial: Identity management still breaks at the authentication boundary