Topic starter
24/06/2026 10:44 pm
TL;DR: Identity security posture management addresses SaaS sprawl, non-human identity growth, and access drift by continuously discovering identities and entitlements, evaluating risk, and automating remediation, according to Omada Identity. Periodic reviews assume access is stable long enough to certify, but ISPM is built around continuous change, not static governance.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “What Is Identity Security Posture Management and Why It Matters”.
Key questions
Q: What breaks when identity reviews happen only on a fixed schedule?
A: Fixed-schedule reviews miss access that is created, used and abused between review cycles.
Q: Why do privileged service accounts create outsized risk in identity environments?
A: Privileged service accounts can be used quietly by attackers to move across systems without triggering the same scrutiny applied to human users.
Q: What should teams measure to know whether identity posture management is working?
A: Measure how quickly risky access is detected, how often high-risk entitlements are remediated, and whether posture evidence can be produced continuously for audit and board reporting.
Practitioner guidance
- Map identity drift continuously Aggregate identity, entitlement, and trust data across directories, SaaS, cloud platforms, and privileged access tools so you can see current exposure, not last quarter’s state.
- Prioritise high-risk identity combinations Score over-privileged accounts, dormant accounts, shared accounts, and toxic entitlement combinations so remediation targets the exposures most likely to widen blast radius.
- Connect posture findings to enforcement workflows Trigger revocation, step-up authentication, or escalation when access violates policy so remediation follows the risk signal instead of waiting for manual review.
Bottom line: Identity Security Posture Management is being positioned as the missing continuous layer between IAM, IGA, and identity response.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:32 am
Identity posture is becoming the operating layer of governance, not a report outcome. Static reviews were built for a world where access changed slowly enough to be certified after the fact. That assumption no longer holds in SaaS-heavy environments where non-human identities and entitlements change continuously. The implication is that identity governance now needs a live control plane, not a retrospective audit rhythm.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should teams decide whether to use IAM, IGA, or both?
A: Use IAM for identity execution tasks such as authentication, provisioning, and access control. Use IGA when you need governance, certification, policy enforcement, and auditability. Most mature programmes need both because secure access is not the same as justified access. If the organisation cannot answer why access exists, IAM alone is not enough.
👉 Read our full editorial: Identity security posture management is becoming an identity control plane