Notifications
Clear all
Topic starter
25/06/2026 12:28 am
TL;DR: Remote and hybrid work have exposed the limits of spreadsheet-driven, quarterly IGA, because access changes faster than manual certification cycles can track, according to SecurEnds. Continuous governance now matters more than periodic clean-up, and the real challenge is keeping entitlements, offboarding, and audit evidence aligned with how people actually work.
NHIMG editorial — based on content published by SecurEnds: IGA for remote work and hybrid work environments
Questions worth separating out
Q: How should security teams govern access in remote and hybrid work environments?
A: They should move from periodic certification to event-driven governance tied to role changes, app access, and offboarding.
Q: Why do traditional IGA models break down in remote work?
A: They rely on static review cadences, slow approvals, and on-prem assumptions that no longer match how people access systems.
Q: What do teams get wrong about continuous compliance in identity governance?
A: They often treat compliance as reporting rather than control.
Practitioner guidance
- Shorten review cycles around identity change events Tie access recertification to role changes, privileged assignments, and application additions so reviews reflect current entitlements instead of quarter-end snapshots.
- Automate joiner-mover-leaver actions across cloud and on-prem systems Use event-driven provisioning and deprovisioning so HR updates, role changes, and exits trigger immediate access correction in connected applications.
- Prioritise high-risk access for continuous monitoring Focus continuous checks on privileged users, shared accounts, and accounts with broad SaaS reach, because those identities create the highest governance drift.
What's in the full article
SecurEnds' full article covers the operational detail this post intentionally leaves for the source:
- A feature-by-feature view of how the platform centralises access, entitlement tracking, and certification workflows for distributed teams.
- Implementation-oriented discussion of API-driven integrations with HR, directory, and SaaS systems across cloud and on-prem estates.
- The article's comparison of automated provisioning, risk-based reviews, and continuous compliance capabilities in a remote-work context.
- The product-specific description of its dashboards and review automation for practitioners planning deployment.
👉 Read SecurEnds' analysis of IGA for remote and hybrid work →
Remote-work IGA: what identity teams need to change now?
Explore further
25/06/2026 9:23 am
Remote-work IGA is no longer an access review problem, it is a control latency problem. The article's central point is that access changes faster than quarterly governance can observe, certify, and remove. That makes timing the failure mode, not merely manual effort. The practical conclusion is that identity programmes must be measured by how quickly they close the gap between business change and access change.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, which shows how often governance expectations outpace operational behaviour.
A question worth separating out:
Q: Who is accountable when orphaned access appears after offboarding?
A: Accountability sits with the identity governance process owner, the HR-to-IT workflow owner, and the application owner if integrations fail to remove access. In practice, offboarding is only complete when the entitlement change is propagated across every connected system and recorded in the audit trail.
👉 Read our full editorial: Remote-work IGA is shifting from quarterly reviews to real-time control
