Topic starter
06/11/2026 6:37 pm
TL;DR: Identity programmes can identify orphaned accounts, shadow admins and stale privileges for months without improving security, because discovery tools often cannot enforce changes across the apps where problems live, according to Way Security. The real gap is remediation, not visibility, and governance evidence stays weak until finding and fix share the same control path.
Editorial analysis by NHI Mgmt Group, based on content published by Way Security: “A Finding Is Not a Fix”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: How should teams decide which identity risks can be remediated automatically?
A: Use policy, reversibility and ownership certainty as the threshold.
Q: Why do identity findings keep coming back even after reviews?
A: Identity findings keep coming back when the underlying entitlement, ownership or lifecycle control is not fixed, so the review only records the symptom.
Q: What is the best way to prove identity remediation for audits?
A: The best proof is a remediation trail that shows the finding, the action taken, the approver, the completion date and validation that the access was removed or corrected.
Practitioner guidance
- Define a remediation closure standard Require every identity finding to have a documented change path, not just an owner and a ticket.
- Inventory unenforced applications List the legacy, homegrown and disconnected applications that your current identity stack can observe but cannot modify.
- Shorten review-to-remediation cycles Measure the elapsed time between detecting a stale identity and removing the access.
Bottom line: Identity hygiene fails when reporting and enforcement are split across different systems and teams.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Visibility without enforcement is not a control posture. A programme can generate complete-looking findings and still leave the underlying risk untouched if no governed mechanism exists to change access on the target system. That is why posture scores often flatter the environment more than they reduce exposure. Practitioners should measure whether a finding can become a change, not just whether it can become a ticket.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the best way to prove identity remediation for audits?
A: The best proof is a remediation trail that shows the finding, the action taken, the approver, the completion date and validation that the access was removed or corrected. For audits, Live remediation records tied to tickets, approval logs, revocation evidence and re-scan results are stronger than a signed review alone.
👉 Read our full editorial: Visibility without enforcement leaves identity hygiene unresolved