Topic starter
24/06/2026 8:03 pm
TL;DR: 20,000+ users shows how Hydden's case work maps legacy platforms, custom permission stores, and service-account sprawl to incomplete IGA and PAM coverage. That leaves the hardest systems outside review, so access evidence and lifecycle control stay partial.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “The Technical Reality of Identity Security in a 20,000+ User Organization”.
Key questions
Q: Why do legacy entitlements and service accounts create residual risk?
A: They remain risky because they often persist without ownership, rotation or reliable mapping to business roles.
Q: How can IAM teams tell whether access review coverage is actually meaningful?
A: They should measure what was excluded as well as what was approved.
Q: What breaks when identity governance cannot reach legacy and core systems?
A: Access reviews, entitlement discovery, and compliance evidence all become partial.
Practitioner guidance
- Map identity data blind spots Identify every critical system that your IGA and PAM stack cannot currently inventory, certify or onboard, then rank them by privilege exposure and business criticality.
- Separate non-human identity governance Create a dedicated inventory and ownership model for service accounts, local system users and script-bound credentials so they are not hidden inside human user review cycles.
- Replace spreadsheet-led certifications Use automated or semi-automated data extraction for legacy platforms where manual access reviews are still the only path to entitlement evidence.
Bottom line: Large enterprises can have mature identity policy language and still fail to govern the systems that carry the real risk.
Glossary terms: Identity Data Bridge, Identity Drift, Service-account sprawl, Time To Governance Coverage
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 12 hours ago by NHI Mgmt Group
25/06/2026 5:12 am
Identity hygiene at scale fails because policy does not govern what the platform cannot see. Large enterprises often assume written standards translate into enforceable controls across the estate, but legacy systems and custom data stores break that assumption. When entitlement data cannot be extracted and normalised, access governance becomes partial by design. The practitioner conclusion is that visibility, not policy language, is the real limiting factor.
A question worth separating out:
Q: Should organisations prioritise legacy data extraction or new governance features first?
A: They should prioritise data extraction when the existing governance stack cannot see critical systems. New features add little if the underlying entitlement data is incomplete, because visibility is the prerequisite for certification, offboarding and privileged access control.
👉 Read our full editorial: Identity hygiene at scale breaks where legacy infrastructure outlives policy