Topic starter
09/07/2026 1:42 pm
TL;DR: Most identity programs govern what should happen, but very few can prove what actually happened inside applications, according to Orchid Security’s recap of its Identiverse session. The execution gap now matters more than certification cadence, because access reviews document intent while real risk lives in live identity behavior.
Editorial analysis by NHI Mgmt Group, based on content published by Orchid Security: “From Seeing to Knowing: What Happened When We Asked an Identiverse Room to Be Honest”.
Key questions
Q: What breaks when access reviews are the primary identity control?
A: The control breaks because access can change, be abused, and disappear between review cycles.
Q: Why do identity dark matter identities create governance risk?
A: They sit outside normal joiner-mover-leaver and review workflows, so they can keep authenticating and executing after the organisation has lost sight of them.
Q: How should security teams prove what identities are actually doing inside applications?
A: They should combine identity governance records with application-layer telemetry, then validate live actions against policy instead of relying on certification alone.
Practitioner guidance
- Map application-executing identities Build a separate inventory for identities that act inside applications, including service accounts, local accounts, tokens, and app-specific users.
- Correlate runtime actions to identity ownership Link each significant application action to a human owner, non-human owner, or agent owner, and preserve the chain from identity to tool to target.
- Shift reviews from entitlement to behaviour Use access reviews to confirm intent, but add continuous behavioural checks that compare live execution against approved purpose.
Bottom line: The article argues that identity governance is increasingly failing at runtime visibility, not at policy definition.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 1:46 pm
Identity governance is now an execution problem, not just an access problem: The article correctly separates what access was approved from what actually occurred inside the application. That distinction matters because the control gap is no longer at provisioning alone; it is at runtime attribution and behavioural proof. Practitioners should read this as a warning that access intent without execution evidence is incomplete governance.
A question worth separating out:
Q: Should organisations prioritise execution observability over another access review cycle?
A: Yes, when the main risk is that live application behaviour no longer matches what access records imply. Another review cycle may certify intent again, but execution observability is what reveals whether non-human identities, agents, or users are actually operating within policy.
👉 Read our full editorial: Identity observability gap is widening beyond access reviews