Topic starter
11/06/2026 11:44 pm
TL;DR: As SaaS sprawl, remote work, and delayed revocation erode perimeter controls, identity governance and administration has become the mechanism for enforcing least privilege, continuous access review, and audit-ready accountability, according to Zluri. The governance problem is no longer authentication alone, but whether access is still justified across human and non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Identity-First Security: How IGA Became the Core of Modern Cyber Strategy”.
By the numbers:
- Stolen or compromised credentials remain the leading cause of breaches, with an average cost of $4.9 million per incident, according to IBM’s 2024 Cost of Data Breach report cited by Zluri.
- The average breach cost cited in the article rose by 10% over the last year, according to IBM’s 2024 Cost of Data Breach report cited by Zluri.
Key questions
Q: Where does IAM fail when organisations rely on it for access governance?
A: IAM fails when it is used as the only control for access governance, because it proves identity at login but does not show whether access is still needed, who approved it or whether it was ever reviewed.
Q: Why do delayed revocation and stale entitlements create so much risk?
A: They extend the lifetime of access beyond the business reason that justified it.
Q: What are the signs that user access reviews are not working well?
A: Common warning signs include long review cycles, heavy reliance on spreadsheets, inconsistent evidence collection, and app owners who delay or ignore assigned reviews.
Practitioner guidance
- Inventory every access source Map entitlements across the IdP, HRIS and each SaaS application so access ownership is visible in one governance view.
- Automate lifecycle-based revocation Trigger deprovisioning when employment status, contractor scope or project assignment changes instead of waiting for periodic review cycles.
- Separate authentication from governance Use IAM for login control, but require IGA for approval history, access justification and entitlement recertification across the estate.
Bottom line: Identity-first security reframes IGA as the place where access justification, review and revocation are enforced across the estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 8:33 am
Identity-first security turns IGA into the programme’s control plane: The article is describing a governance shift, not a tooling preference. Once access decisions span SaaS, HRIS and machine identities, authentication alone no longer answers the operational question of whether access is still justified. The practitioner conclusion is that access governance now sits at the centre of cyber strategy, not beside it.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Why do service accounts and other non-human identities increase breach impact?
A: Service accounts and other non-human identities increase breach impact because they often carry broad, persistent access and bypass interactive controls like MFA. When those identities are not tightly scoped, rotated, and retired, attackers can reuse them to move quietly across systems, pipelines, and cloud environments. The issue is not the token alone, but the authority attached to it.
👉 Read our full editorial: Identity-first security means IGA now anchors cyber strategy
This post was modified 4 days ago by NHI Mgmt Group