Notifications
Clear all
Topic starter
25/06/2026 12:42 am
TL;DR: AI return on investment only becomes real when outcomes and efficiencies can be counted in production, not in pilots, according to Strata Identity, because traceable identity, scoped tokens, and observability make agent work legitimate and attributable.
NHIMG editorial — based on content published by Strata Identity: Why most companies can’t answer the only question that matters
Questions worth separating out
Q: How should security teams measure AI ROI without relying on pilot metrics?
A: Measure only production outcomes that can be tied to an authorised identity, a bounded task, and a verifiable completion record.
Q: Why do identity controls matter before organisations claim AI productivity gains?
A: Identity controls matter because productivity claims are only credible when the organisation can prove who or what executed the work.
Q: What breaks when AI work cannot be traced back to a delegated identity?
A: What breaks is attribution.
Practitioner guidance
- Define ROAI around attributable outcomes Use completed, authorised transactions as the unit of value, and reject ROI claims that rely on prompts, model calls, or pilot activity.
- Bind AI workflows to scoped delegation Issue tokens or delegated permissions that limit each workflow to a specific task, tool set, and authority boundary.
- Instrument production observability before scale-up Log initiator identity, action path, completion status, and exception handling for every AI-assisted transaction.
What's in the full article
Strata Identity's full article covers the operational detail this post intentionally leaves for the source:
- A practical ROAI formula with example outcome and efficiency calculations that practitioners can adapt for their own board reporting.
- Identity infrastructure patterns for tracing human initiation, agent execution, and outcome attribution in production.
- A sandbox-to-production measurement sequence that shows how to validate value before scale-up.
- The article's own framing for how CFO-facing ROI conversations change once identity evidence is in place.
👉 Read Strata Identity's analysis of how identity controls make ROAI measurable →
ROAI without identity controls: what practitioners are missing?
Explore further
25/06/2026 9:40 am
Identity controls are the proof layer that turns AI activity into ROAI. The article is right to push back on pilot-era storytelling, because output counts are not value unless they are tied to authorised identity and traceable completion. Finance teams do not need more AI enthusiasm. They need a defensible chain from initiator to action to outcome, which is exactly where identity governance earns its place in the AI programme.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How do you know if AI efficiency claims are actually working?
A: They are working only when the same improvement appears in production logs, identity records, and financial reporting. If the gains exist only in a sandbox or in estimated time savings, they are not yet operational evidence. The test is whether the improvement remains visible when the workflow is scaled and audited.
👉 Read our full editorial: Identity controls are the missing foundation for measurable ROAI
