Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: No single IGA, PAM, or IdP can serve as a complete identity system of record because each only knows the identities and credentials inside its own coverage boundary, according to Hydden. That matters because unmanaged accounts, static keys, and unvaulted privilege remain invisible until governance starts from a neutral cross-system record.
NHIMG editorial — based on content published by Hydden: Identity system of record fails when coverage stops at tool boundaries
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
A: Security teams should centralise identity data into one normalized record while keeping each source authoritative for its own domain.
Q: Why do existing IGA and PAM platforms miss parts of the identity estate?
A: Because both tools are authoritative only for the identities they already manage.
Q: What breaks when service accounts and local accounts sit outside the system of record?
A: Certification, offboarding, and audit workflows lose the ability to see those identities at all.
Practitioner guidance
- Build a cross-system identity ledger Collect identity state from IGA, PAM, IdP, HR, and unmanaged infrastructure into one neutral record that can represent accounts the source tools do not share.
- Measure coverage against the full identity estate Compare what each control plane knows with what actually exists in servers, cloud services, applications, and third-party integrations.
- Separate authentication truth from governance truth Use the IdP for federated login evidence, PAM for credential custody, and IGA for access certification, but do not treat any one of them as complete inventory.
What's in the full article
Hydden's full analysis covers the operational detail this post intentionally leaves for the source:
- How Hydden models a neutral identity record across IGA, PAM, IdP, and HR systems
- Examples of how different identity sources contribute partial but non-overlapping history
- Why a cross-system record can surface local accounts, service principals, and unvaulted privilege
- The practical implications for teams trying to reconcile identity ownership before audit or recertification
👉 Read Hydden's analysis of why no single identity system can hold the full record →
Identity system of record gaps: why current tools cannot cover everything?
Explore further
02/09/2026 1:30 pm
Identity records fail when they are bound to the tool that holds them. A record inside IGA, PAM, or an IdP can be authoritative only for the identities that tool already sees. That means completeness is a property of coverage, not of confidence, and confidence is exactly where many programmes overreach. The implication is that identity governance needs a neutral data plane if it is to function across human, NHI, and autonomous estates.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Only 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations use the IdP as the system of record for all identities?
A: No. The IdP is a strong record for federated authentication, but it cannot see local accounts, application-native credentials, or static keys that never pass through it. A complete record must include those non-federated identities and their history.
👉 Read our full editorial: Identity system of record fails when coverage stops at tool boundaries
