Topic starter
24/06/2026 7:29 pm
TL;DR: Identity posture and threat detection worked only where enterprises had complete identity inventories, Hydden says, but fragmented ownership and incomplete data limited both across AD, cloud, SaaS, and service accounts. Without authoritative identity visibility, posture scores and detections can produce confident findings that are hard to act on.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “Why ISPM and ITDR Never Scaled”.
Key questions
Q: Why do posture findings often turn into backlog instead of remediation?
A: Because the tool surfaces issues across multiple domains, but the authority to fix them remains split across directory, cloud, SaaS, and application teams.
Q: How do security teams decide whether ITDR is working?
A: ITDR is working when responders can move from alert to containment without a long investigative detour.
Q: What breaks when identity tools are split across visibility, posture, and detection?
A: The response chain breaks.
Practitioner guidance
- Define a single identity estate inventory Consolidate AD, cloud, SaaS, privileged accounts, and service principals into one continuously reconciled view before relying on posture or detection outputs.
- Assign remediation owners by identity domain Map every posture finding to the team that can actually change it, such as directory, cloud, SaaS, or application owners, before governance review starts.
- Measure detection coverage against unknown accounts Test whether behavioural baselines exist for every privileged identity, including short-lived automation accounts and direct cloud roles, not only for integrated systems.
Bottom line: ISPM and ITDR were useful responses to real identity risk, but their effectiveness depended on a complete identity inventory that most enterprises did not have.
Glossary terms: Identity Security Posture Management, Identity Threat Detection and Response, Identity Inventory, Denominator Problem
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 22 hours ago by NHI Mgmt Group
25/06/2026 4:47 am
Identity posture and identity threat detection fail when the inventory layer is not trustworthy: ISPM and ITDR were built to expose misconfiguration and suspicious authentication behaviour, but both depend on the same upstream truth about what identities exist. When that truth is fragmented across AD, cloud, SaaS, and service accounts, the tools can only analyse partial reality. The practical consequence is not simply lower visibility. It is a governance model that starts reporting on the wrong denominator and then treats those outputs as operational fact.
A question worth separating out:
Q: Should organisations prioritise identity inventory before posture and detection?
A: Yes. A continuously reconciled identity inventory is the control that makes posture scoring and behavioural detection trustworthy. If the inventory is incomplete, both categories can still be useful, but they will produce partial and sometimes misleading outputs that are hard to operationalise at scale.
👉 Read our full editorial: ISPM and ITDR exposed the limits of fragmented identity governance