Topic starter
06/11/2026 6:37 pm
TL;DR: Identity teams often struggle to answer simple access-risk questions fast enough during normal business change, according to Opti, and Gartner found 68% of security teams cite that inability as a cause of delayed initiatives. The governance gap is decision clarity, not raw data volume, because human-only review cannot keep pace with modern identity sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by Opti: “How AI transforms identity into a cybersecurity decision tool”.
Key questions
Q: How should teams speed up access reviews without weakening governance?
A: Use entitlement data, usage signals to pre-populate reviewers’ decisions, then focus human review on exceptions, dormant access, privileged entitlements and mismatched ownership.
Q: Why do manual identity reviews slow business change?
A: Manual identity reviews slow business change because every joiner, mover and leaver event depends on human checking of roles, groups, privileged access and exception cases.
Q: Why do just-in-time permissions not eliminate standing privilege risk?
A: Because they control duration, not entitlement quality.
Practitioner guidance
- Use evidence-first access reviews Build review workflows around usage, peer comparison, and role context so reviewers can answer access questions without assembling a room of experts.
- Prioritise high-friction privileged access cases Start with the accounts and entitlements that most often delay change, especially standing privileged access in production and exception-driven elevation paths.
- Replace static exception handling with time-bound elevation Move intermittent administrative access into short-lived elevation paths so the approval logic reflects actual operational need rather than permanent entitlement.
Bottom line: The core problem is not a lack of security intent, but an inability to explain identity risk fast enough for business change.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Decision clarity is now a core identity governance control, not a reporting luxury. When teams cannot answer who has access, why they have it, and whether they use it, the access review function degrades into delay management. That turns identity governance into a business bottleneck because the organisation cannot make timely, defensible changes. The practical implication is that governance maturity should be judged by decision speed as well as decision accuracy.
A question worth separating out:
Q: How should organisations measure whether identity governance is actually working?
A: Organisations should measure whether governance reduces incident cost, manual workload, and time to detect or contain risky access. If the only visible improvement is fewer tools, the programme may not be effective. Strong governance shows up in faster policy enforcement, clearer ownership, and fewer unreviewed access paths.
👉 Read our full editorial: AI-assisted identity risk can shorten decision cycles