Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: By 2028, 70% of CISOs will use an identity visibility and intelligence platform to reduce IAM attack surface, according to Veza’s citation of Gartner research. The shift reflects a programme reality: visibility, observability, and remediation now define whether human, machine, and AI identities can be governed at scale.
NHIMG editorial — based on content published by Veza: Identity visibility platforms are becoming central to IAM attack surface reduction
By the numbers:
- By 2028, 70% of Chief Information Security Officers will utilize an identity visibility and intelligence platform to shrink their IAM attack surface.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams reduce the attack surface of identity systems?
A: Security teams should reduce identity attack surface by removing standing privilege, closing unnecessary trust paths, tightening authentication controls, and continuously monitoring directory changes.
Q: Why do identity visibility gaps make privilege reduction so difficult?
A: Because entitlement lists do not show how access is inherited, chained, or exercised in practice.
Q: What breaks when organisations treat identity reporting as the same thing as control?
A: Reporting tells you what exists, but control requires knowing what can be reached and what can be changed.
Practitioner guidance
- Map effective access paths Inventory which identities can reach sensitive systems through inherited roles, delegated permissions, and third-party relationships.
- Separate standing privilege from active need Review service accounts, machine credentials, and privileged users for access that persists without a current business owner or operational requirement.
- Prioritise runtime evidence in access reviews Base review decisions on actual usage, last access, and observed sessions so that dormant accounts and rarely used entitlements can be trimmed before they become attack paths.
What's in the full article
Veza's full analysis covers the operational detail this post intentionally leaves for the source:
- Gartner-aligned explanation of the IVIP model and how the Access Graph is used to reduce identity attack surface.
- Practitioner-level breakdown of visibility, observability, and remediation as separate governance capabilities.
- Context on how CISOs can apply the model across human, machine, and AI identities.
- The source article's framing of why these capabilities are becoming mandatory for IAM risk reduction.
👉 Read Veza's analysis of Gartner's identity visibility and intelligence platform view →
Identity visibility platforms: what they mean for IAM attack surface reduction?
Explore further
25/08/2026 6:11 pm
Identity visibility is now a governance control, not a reporting feature. Once identities span users, service accounts, tokens, and AI-connected workflows, basic directory views stop being sufficient for risk reduction. The operational question is no longer who exists in the directory, but which identities can actually reach sensitive assets and through which paths. Practitioners should treat identity visibility as part of control design, not post-hoc reporting.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which leaves most machine access governance operating with partial evidence.
A question worth separating out:
Q: What should IAM teams prioritise first in a modern identity strategy?
A: They should prioritise a unified identity foundation, then automate the highest-risk lifecycle events. If identity data remains fragmented across HR, directory, cloud, and SaaS systems, every downstream control will be inconsistent. Once the foundation is in place, offboarding, temporary access expiry, and entitlement discovery become much easier to govern.
👉 Read our full editorial: Identity visibility platforms are becoming central to IAM risk reduction
