Topic starter
14/07/2026 4:26 pm
TL;DR: NHI maturity is uneven across discovery, lifecycle, authentication, authorization, runtime, and delegation, according to Identra.ai. A single score can mask gaps between visible identities and the ones that are actually governed.
Editorial analysis by NHI Mgmt Group, based on content published by Identra.ai: “Rate your program, honestly”.
Key questions
Q: What happens when discovery outpaces governance in an NHI programme?
A: The organisation gains visibility faster than it gains control.
Q: What are the warning signs that NHI lifecycle controls are failing?
A: Warning signs include stale secrets that remain valid after a system changes, service accounts with no clear owner, interactive use of machine identities, and credentials that appear in code or pipelines outside a vault.
Q: How should teams score NHI maturity without overstating progress?
A: Score each dimension independently and use evidence, not aspiration, as the benchmark.
Practitioner guidance
- Score each maturity dimension separately Build a matrix for discovery, lifecycle, authentication, authorization, runtime, and delegation, then rate each row on its own evidence rather than averaging them into one programme score.
- Define governable evidence for each dimension Require proof of authoritative system coverage, principal resolution, ownership, and tested stop paths before marking a dimension as governed.
- Measure the discovery-to-governance gap Track how many identities are found versus how many have verified owners, revocation paths, and containment controls that actually work under pressure.
Bottom line: NHI maturity should be assessed by dimension because discovery, lifecycle, authentication, authorization, runtime, and delegation do not advance together.
Glossary terms: NHI Maturity Model, Governable Identity, Runtime containment, Delegated Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
14/07/2026 4:33 pm
Visibility is not maturity: A programme can have broad discovery coverage and still be immature where ownership, containment, and delegated authority are concerned. The maturity matrix is valuable because it breaks the false assumption that an inventory of identities equals governance of identities. The practitioner conclusion is simple: count the gap between found identities and governable identities, not just the count of identities themselves.
A question worth separating out:
Q: Why do delegated actions need separate governance from service accounts?
A: Delegated actions can preserve task, user, and purpose context while shifting execution through agents or tools. That means the control question is not only who has a credential, but who can act, under what context, and with what stop path.
👉 Read our full editorial: NHI maturity is uneven across discovery, runtime, and delegation