Notifications
Clear all
Topic starter
25/06/2026 12:44 am
TL;DR: Manual identity governance creates bottlenecks in approvals, entitlement updates, and access visibility, leaving organisations exposed when leaders cannot answer who has access and why, according to RSA Security. The governance problem is not just inefficiency, it is the inability to make timely, auditable access decisions before gaps become breaches.
NHIMG editorial — based on content published by RSA Security: From Bottlenecks to Breaches, Why Manual Identity Governance Puts Organizations at Risk
Questions worth separating out
Q: How should security teams reduce risk in manual identity governance processes?
A: Security teams should remove repeatable approval work from email and spreadsheet handling, then tie each access decision to identity context, entitlement state, and ownership.
Q: Why does fragmented access visibility create governance risk?
A: Fragmented visibility creates risk because no one can reliably explain who has access, why it exists, or whether it is still justified.
Q: What do teams get wrong about automating identity governance?
A: Teams often automate the routing of work without fixing the underlying evidence problem.
Practitioner guidance
- Map every manual approval path to a governance risk Identify where access changes, entitlement updates, and recertifications still depend on email, chat, or ad hoc routing.
- Build a single evidence record for each identity Consolidate approval history, entitlement state, owner information, and last review outcome so each access decision can be explained without chasing multiple systems.
- Replace script dependence with governed workflows Use repeatable workflow design for access reviews, approval routing, and entitlement changes so governance does not depend on fragile custom code.
What's in the full article
RSA Security's full blog post covers the operational detail this post intentionally leaves for the source:
- The webinar discussion flow and the specific perspectives shared by each RSA speaker.
- The low-code and no-code workflow walkthrough that shows how governance is streamlined in practice.
- The audience questions and implementation detail that sit behind the high-level governance observations.
- The full recording for teams that want to see the product-adjacent workflow context directly from RSA Security.
👉 Read RSA Security's discussion of why manual identity governance raises breach risk →
Manual identity governance: what it means for access risk?
Explore further
25/06/2026 9:44 am
Manual identity governance is a control delay problem, not just an efficiency problem. When approvals and entitlement updates depend on inbox handling, the programme loses the ability to act at the pace of access change. The result is governance lag, where risk accumulates faster than the control process can close it. Practitioners should treat delay itself as a control weakness, not a back-office inconvenience.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows how quickly one access weakness can become repeated governance failure.
A question worth separating out:
Q: How can organisations tell if identity governance is actually working?
A: Governance is working when teams can answer access questions quickly, recertification produces clear outcomes, and entitlement updates do not stall in queues. A stronger sign is when auditors and business owners can trace a decision back to evidence without manual detective work. If that is not possible, the control is still too dependent on people.
👉 Read our full editorial: Manual identity governance is turning access gaps into breach risk
