Topic starter
25/08/2026 6:10 pm
TL;DR: Identity risk signals can be turned into ServiceNow work items through an Actions workflow, with triggers from Access Intelligence Rules, lifecycle events, and access review decisions, according to Veza. The practical shift is from detection-only visibility to closed-loop remediation, where identity context drives routing, prioritisation, and downstream deprovisioning.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “From Insight to Action: Automating Identity Remediation with Veza and ServiceNow”.
Key questions
Q: How should teams turn identity risk findings into remediation work items?
A: Teams should map each identity signal to a defined workflow outcome, owner, and severity before it reaches ITSM.
Q: When does identity remediation automation improve governance rather than create noise?
A: It improves governance when the workflow closes the loop from detection to action.
Q: What breaks when access review decisions do not trigger downstream action?
A: The control stops at the decision point and never changes the underlying access state.
Practitioner guidance
- Define identity-to-ticket routing rules Map specific identity findings such as inactive user mappings, toxic combinations, and NHI anomalies to distinct ServiceNow queues, severities, and owners.
- Preserve identity context in the payload Ensure the event contains who, what and where fields, plus a direct link back to the access graph, so the assignee can verify the risk without reconstruction.
- Automate deny-to-deprovision workflows Treat access review denials and lifecycle events as triggers for downstream removal actions, not as reporting artefacts that wait for manual follow-up.
Bottom line: Identity remediation fails when findings stay trapped in alerts instead of becoming owned, prioritised work items.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Closed-loop remediation is now a governance requirement, not a workflow convenience. Identity programmes that stop at detection leave the real control gap untouched. Once a risk has been identified, the security value depends on whether the remediation path is automated, attributable and reviewable. Practitioners should treat this as identity governance operating inside ITSM rather than beside it.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do identity remediation workflows differ for NHI issues and human access issues?
A: NHI issues often need system owner, application owner, or cloud team routing because the identity is embedded in workloads and integrations. Human access issues more often route through manager, HR, or helpdesk processes. The workflow should reflect who can actually remove the access and confirm closure.
👉 Read our full editorial: ServiceNow-driven identity remediation changes NHI governance