Notifications
Clear all
10/06/2026 9:33 pm
ITOM visibility is not identity control. A dashboard that shows service health, log volume, and incident response timing does not tell you whether the underlying machine identities are still appropriate. That gap matters because identity risk is often hidden inside stable operations. Practitioners should read ITOM tooling as evidence collection, not governance.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to the 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows how quickly identity weakness compounds once machine access is exposed.
A question worth separating out:
Q: What is the difference between observability and access governance?
A: Observability tells you what systems are doing. Access governance tells you what identities are allowed to do it. In practice, observability surfaces symptoms such as failures or unusual activity, while access governance manages ownership, entitlements, revocation, and review. Organisations need both, but they answer different questions and require different controls.
👉 Read our full editorial: IT operations management tools in 2026 and identity risk
