Topic starter
14/07/2026 4:26 pm
TL;DR: NHI maturity is rarely uniform, and an assessment matrix splits governance into six dimensions spanning discovery, lifecycle, authentication, authorization, runtime, and delegation so teams can score each on evidence rather than optimism, according to Identra.ai. The core implication is that governance collapses when organisations treat visibility as maturity and ignore the accountability gap between discovered identities and governed identities.
Editorial analysis by NHI Mgmt Group, based on content published by Identra.ai: “Rate your program, honestly”.
Key questions
Q: How should teams score NHI maturity without overstating progress?
A: Score each dimension independently and use evidence, not aspiration, as the benchmark.
Q: What happens when discovery outpaces governance in an NHI programme?
A: The organisation gains visibility faster than it gains control.
Q: What are the warning signs that NHI lifecycle controls are failing?
A: Warning signs include stale secrets that remain valid after a system changes, service accounts with no clear owner, interactive use of machine identities, and credentials that appear in code or pipelines outside a vault.
Practitioner guidance
- Score each maturity dimension separately Build a matrix for discovery, lifecycle, authentication, authorization, runtime, and delegation, then rate each row on its own evidence rather than averaging them into one programme score.
- Define governable evidence for each dimension Require proof of authoritative system coverage, principal resolution, ownership, and tested stop paths before marking a dimension as governed.
- Measure the discovery-to-governance gap Track how many identities are found versus how many have verified owners, revocation paths, and containment controls that actually work under pressure.
Bottom line: NHI maturity should be assessed by dimension because discovery, lifecycle, authentication, authorization, runtime, and delegation do not advance together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:33 pm
Visibility is not maturity: A programme can have broad discovery coverage and still be immature where ownership, containment, and delegated authority are concerned. The maturity matrix is valuable because it breaks the false assumption that an inventory of identities equals governance of identities. The practitioner conclusion is simple: count the gap between found identities and governable identities, not just the count of identities themselves.
A question worth separating out:
Q: Why do delegated actions need separate governance from service accounts?
A: Delegated actions can preserve task, user, and purpose context while shifting execution through agents or tools. That means the control question is not only who has a credential, but who can act, under what context, and with what stop path.
👉 Read our full editorial: NHI maturity is uneven across discovery, runtime, and delegation