Topic starter
23/06/2026 9:23 pm
TL;DR: Clarity Security says 71% of organizations experienced a breach last year even though most already had SSO, MFA, and regular access reviews in place, showing that identity programmes built for compliance can still leave material security exposure. The problem is not control volume but a model that documents access instead of reducing risk in real time.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “The Three Stages of Identity Security Maturity and Why Most Programs Were Built for the Wrong Problem”.
By the numbers:
- 71% of organizations experienced a security breach last year, according to Clarity Security.
- Non-human identities now outnumber human identities by 144 to 1 and that ratio is growing by 44% annually, according to Clarity Security.
Key questions
Q: What breaks when identity programmes are built mainly for compliance evidence?
A: They become good at proving that access was reviewed, provisioned, and deprovisioned on schedule, but weak at reducing live exposure.
Q: Why do mature IAM controls still leave organisations exposed?
A: Because SSO, MFA, and access reviews solve governance and authentication problems, but they do not automatically limit how long valid access can remain risky.
Q: What are the signs that an identity programme is stuck in Conditional Trust?
A: Look for strong provisioning workflows, scheduled access recertifications, and a heavy emphasis on audit trails, but little evidence that exposure is reduced between review cycles.
Practitioner guidance
- Reclassify access reviews as governance evidence Use review completion to prove oversight, but do not treat it as proof that live access risk has been reduced.
- Separate human and non-human identity operating models Inventory service accounts, API keys, OAuth tokens, and AI agents as a distinct estate with explicit ownership, retirement, and exception handling.
- Test for continuously valid access paths Look for federated identities, nested group memberships, and role changes that increase access without a matching automatic reduction.
Bottom line: The report's central warning is that identity maturity can look strong while breach exposure remains unchanged because the programme is built around proof, not prevention.
What's in the full report
Clarity Security's full report covers the operational detail this post intentionally leaves for the source:
- The three-stage maturity model with the report's full definitions of Inherent Trust, Conditional Trust, and Adaptive Trust
- The underlying breach data and the report's interpretation of why mature identity programmes still leave exposure
- The report's stage-by-stage diagnosis of where human identity, federated access, and non-human identity controls diverge
- The full argument connecting regulatory history, identity governance design, and present-day security outcomes
👉 Read Clarity Security's report on the three stages of identity security maturity →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
25/06/2026 2:41 am
Compliance assurance is not the same as security control: The identity category was shaped to prove that access was managed according to process, not to close risk in motion. That design choice made sense under Sarbanes-Oxley pressure, but it now leaves modern programmes optimised for auditability instead of defence. Practitioners should stop treating review completion as evidence of reduced exposure.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should teams respond when non-human identities outgrow their intended scope?
A: Revalidate ownership, scope, and offboarding status for service accounts, workloads, and AI agents before adding more access. When machine identities scale faster than governance, the correct response is to shrink persistence and narrow reach, not simply to monitor a larger estate more closely.
👉 Read our full editorial: Identity security maturity is still missing the security problem
This post was modified 5 days ago by NHI Mgmt Group