Notifications
Clear all
Topic starter
09/07/2026 1:39 pm
TL;DR: Identity security teams still rely on static tiers and alert volume, even though those methods miss how identities behave in real time; Permiso’s analysis argues for continuous, evidence-backed scoring across posture, likelihood, and impact, with score velocity as an early compromise signal. Static labels and queue-based triage are no longer enough when human, NHI, and AI identities all move at machine speed.
NHIMG editorial — based on content published by Permiso Security: You Can't Manage What You Can't Score: Why Identity Security Needs Real Risk Measurement
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams measure identity risk instead of using static tiers?
A: Security teams should measure identity risk continuously, using posture and runtime behaviour together rather than assigning a fixed label once and revisiting it later.
Q: Why do static identity labels fail to reflect real exposure?
A: Static labels fail because they describe permission at a point in time, not the identity’s present behaviour or compromise likelihood.
Q: How do security teams know if identity risk scoring is working?
A: Identity risk scoring is working when the programme can explain why scores changed, when score movement predicts incidents before they become obvious, and when remediation measurably lowers exposure.
Practitioner guidance
- Replace static identity tiers with continuous scoring Map your current low, medium, and high labels to live behavioural, likelihood, and impact signals so the score changes as the identity changes.
- Treat score velocity as a control trigger Define thresholds for rapid score movement that can initiate step-up authentication, session restriction, or analyst review before an identity reaches its objective.
- Unify scoring across human and non-human identities Apply the same measurement model to users, service accounts, API keys, OAuth grants, IAM roles, and AI agents so the programme can compare exposure consistently.
What's in the full article
Permiso Security's full analysis covers the implementation detail this post intentionally leaves for the source:
- How the Risk Score Engine combines posture, runtime behaviour, and impact into a single scoring model.
- How session scoring and organisation-level benchmarking are used in practice for SOC and CISO reporting.
- How score velocity can be turned into response logic such as step-up checks or session restriction.
- How the Universal Identity Graph correlates identity activity across IdPs, cloud, SaaS, and infrastructure.
👉 Read Permiso Security's analysis of continuous identity risk scoring and score velocity →
Identity risk scoring: are static tiers still hiding real exposure?
Explore further
09/07/2026 1:42 pm
Static identity tiers are a measurement failure, not a governance model. Static labels say what an identity was allowed to do at review time, but they do not tell you whether that identity is now behaving like an exposed credential, a dormant privilege, or an active compromise. That is why static tiering persists as a reporting habit while failing as operational risk management. The implication is that identity governance needs continuous evidence, not periodic categorisation.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to our Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means most identity programmes still cannot measure their non-human attack surface accurately.
A question worth separating out:
Q: Who should use identity risk scores in an enterprise programme?
A: CISOs, IAM leads, SOC teams, PAM owners, and NHI practitioners should all use the same identity risk view because the attack surface now includes human accounts, service identities, API keys, and AI agents. Shared measurement makes the programme consistent across governance, detection, and enforcement.
👉 Read our full editorial: Identity risk scoring needs continuous measurement, not static tiers
