Topic starter
25/06/2026 1:34 pm
TL;DR: As organisations face remote work, compliance pressure, and cyber risk shifts, identity security must evolve continuously, according to SailPoint, while introducing Atlas, Data Access Security, Activity Insights, and MySailPoint to support that model. The key issue is not feature breadth but whether identity programmes can adapt without re-architecture as the environment changes.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Identity Security: A continuous journey in the evolving digital landscape”.
Key questions
Q: How should identity security programmes adapt when the business keeps changing?
A: They should be run as continuous operating models, not one-time projects.
Q: Why do access reviews become weaker when teams ignore activity data?
A: Because reviewers end up certifying entitlements without knowing whether the access is actually used.
Q: Why does unstructured data create identity governance risk?
A: Unstructured data creates risk when access is spread across repositories and shares without clear entitlement ownership or review.
Practitioner guidance
- Reframe identity security as an operating model Treat identity governance as a continuous programme with planned updates for business change, compliance change, and risk change rather than a fixed rollout.
- Extend governance to unstructured data Add discovery and classification for critical unstructured data so identity controls can govern the information layer, not only application entitlements.
- Use activity evidence in access reviews Feed application usage patterns into recertification so reviewers can see whether access is active, dormant, or no longer justified.
Bottom line: The article’s central point is that identity security must be governed as a continuous programme because enterprise conditions keep changing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:34 pm
Identity security fails when programmes are built as projects instead of operating models. The article’s core message is that enterprise change is continuous, so governance cannot stop at deployment. Once remote work, compliance shifts, and data growth are all happening at once, a static identity programme becomes a lagging control rather than a living control. The practitioner conclusion is that identity security must be managed as an ongoing operating discipline.
A question worth separating out:
Q: Should organisations prioritise identity visibility or access automation first?
A: Visibility comes first. If teams cannot see who has access, how that access is used, and where sensitive data lives, automation simply accelerates incomplete governance rather than improving it.
👉 Read our full editorial: Identity security as a continuous programme, not a destination