Topic starter
11/07/2026 1:55 pm
TL;DR: The Semperis acquisition of MightyID is framed as evidence that identity resilience has matured into a distinct category because identity providers now sit at the center of business operations, yet most organisations still lack recovery paths for outages, misconfigurations, and admin compromise, according to Acsense. The market signal is clear: detection and prevention alone are not enough when identity becomes critical infrastructure.
Editorial analysis by NHI Mgmt Group, based on content published by Acsense: “Semperis Acquires MightyID: Identity Resilience Goes Mainstream”.
Key questions
Q: What breaks when identity resilience is missing during an outage?
A: When identity resilience is missing, users may be locked out, applications can fail to authenticate, and privileged workflows can stop even if the underlying infrastructure is healthy.
Q: When should organisations treat identity recovery as a high-risk control?
A: Organisations should treat recovery as high-risk whenever the process can grant access, add a device, or reset a factor without strong independent verification.
Q: What are the signs that an IAM program is failing in practice?
A: Common signs include backlog in provisioning, repeated audit findings, unclear ownership for access changes, and growing role bloat.
Practitioner guidance
- Define identity recovery objectives Set explicit RTO and RPO targets for identity tenants, federation services and privileged access paths, then test whether those targets are actually achievable during an outage.
- Test dependency-aware restoration Validate that a restored tenant can authenticate users, authorise applications and re-establish MFA, SSO and trust relationships in the right sequence.
- Separate detection from restoration Create distinct runbooks for identity incident detection, containment and recovery so alerting does not get confused with service restoration.
Bottom line: Identity resilience is what closes the gap between knowing an identity incident happened and restoring the enterprise to working authentication and authorisation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:06 pm
Identity resilience is a market category because identity has become operational infrastructure. The acquisition of MightyID by Semperis reflects category formation, not just consolidation. Once identity providers mediate workforce access, customer authentication, SaaS access and privileged paths, the question shifts from control to continuity. Practitioners should treat identity recovery as part of core resilience planning, not as a niche add-on.
A question worth separating out:
Q: How does identity resilience differ from ITDR in practice?
A: ITDR is about detecting and responding to identity misuse. Identity resilience is about restoring the identity environment itself after failure, including trust relationships, policy state and service availability. They are complementary, but they solve different operational problems and should be governed as separate capabilities.
👉 Read our full editorial: Semperis acquires MightyID and identity resilience matures