Topic starter
24/06/2026 10:44 pm
TL;DR: Identity Security Posture Management, Omada Identity says, is meant to catch SaaS sprawl, non-human identity growth, and access drift as they change. Continuous discovery and remediation keep least privilege enforceable between reviews.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “What Is Identity Security Posture Management and Why It Matters”.
Key questions
Q: Why do privileged service accounts create outsized risk in identity environments?
A: Privileged service accounts can be used quietly by attackers to move across systems without triggering the same scrutiny applied to human users.
Q: What should teams measure to know whether identity posture management is working?
A: Measure how quickly risky access is detected, how often high-risk entitlements are remediated, and whether posture evidence can be produced continuously for audit and board reporting.
Q: What breaks when identity reviews happen only on a fixed schedule?
A: Fixed-schedule reviews miss access that is created, used and abused between review cycles.
Practitioner guidance
- Map identity drift continuously Aggregate identity, entitlement, and trust data across directories, SaaS, cloud platforms, and privileged access tools so you can see current exposure, not last quarter’s state.
- Prioritise high-risk identity combinations Score over-privileged accounts, dormant accounts, shared accounts, and toxic entitlement combinations so remediation targets the exposures most likely to widen blast radius.
- Connect posture findings to enforcement workflows Trigger revocation, step-up authentication, or escalation when access violates policy so remediation follows the risk signal instead of waiting for manual review.
Bottom line: Identity Security Posture Management is being positioned as the missing continuous layer between IAM, IGA, and identity response.
Glossary terms: Identity Security Posture Management, Identity Risk Posture, Identity Attack Surface, Answer Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:32 am
Identity posture is becoming the operating layer of governance, not a report outcome. Static reviews were built for a world where access changed slowly enough to be certified after the fact. That assumption no longer holds in SaaS-heavy environments where non-human identities and entitlements change continuously. The implication is that identity governance now needs a live control plane, not a retrospective audit rhythm.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should teams decide whether to use IAM, IGA, or both?
A: Use IAM for identity execution tasks such as authentication, provisioning, and access control. Use IGA when you need governance, certification, policy enforcement, and auditability. Most mature programmes need both because secure access is not the same as justified access. If the organisation cannot answer why access exists, IAM alone is not enough.
👉 Read our full editorial: Continuous identity posture is the gap between review cycles
This post was modified 1 day ago by NHI Mgmt Group