Notifications
Clear all
Topic starter
10/07/2026 9:29 pm
TL;DR: Zero Trust fails in practice when organisations cannot answer who can access what, when that access should end, and how to govern human and non-human identities with the same rigor, according to Soffid. Identity governance is the control layer that turns Zero Trust from policy language into enforceable access decisions.
NHIMG editorial — based on content published by Soffid: Zero Trust Identity, why identity governance is the core of modern security
By the numbers:
- 80% of security breaches have one thing in common: someone accessed something they shouldn’t have.
Questions worth separating out
Q: What breaks when Zero Trust is applied without identity governance?
A: Zero Trust loses its enforcement layer when identity governance is missing.
Q: Why do NHIs complicate Zero Trust programmes?
A: NHIs complicate Zero Trust because they are persistent, high-volume, and often managed outside the human access lifecycle.
Q: How do security teams know whether identity governance is actually working?
A: Look for measurable evidence that access is current, reviewed, and revocable.
Practitioner guidance
- Create a unified identity inventory Build one authoritative view of employees, contractors, service accounts, bots, API keys, and AI-adjacent access paths so Zero Trust decisions are not made from fragmented records.
- Tie revocation to lifecycle events Connect joiner, mover, leaver, vendor-offboarding, and workload decommissioning events to automatic access removal so dormant permissions do not survive the business need.
- Review NHIs on their own cadence Do not reuse human access review schedules for machine identities.
What's in the full article
Soffid's full article covers the operational detail this post intentionally leaves for the source:
- How Soffid describes its unified IAM, AM, PAM, and IGA operating model for Zero Trust enforcement.
- The article's practical examples of automated account creation, modification, and deletion across the identity lifecycle.
- Its discussion of access in minutes, zero ghost permissions, and audit-readiness as implementation outcomes.
- The vendor's own view of how Zero Trust and least privilege fit together in a single control architecture.
👉 Read Soffid's article on why identity governance is the core of Zero Trust security →
Zero Trust identity governance: is your access model keeping up?
Explore further
10/07/2026 9:51 pm
Zero Trust fails when identity governance is treated as paperwork rather than enforcement. The article correctly frames identity as the control point, but the deeper issue is that Zero Trust cannot operate on static assumptions about access. If provisioning, review, and revocation do not stay aligned with real identity state, the policy layer is only simulating control. Practitioners should treat governance accuracy as the condition for Zero Trust viability.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which leaves a large delegated-access surface outside routine identity review.
A question worth separating out:
Q: Who is accountable when stale access remains in place?
A: Accountability should sit with the identity owner, the application owner, and the governance process owner together. If no one owns entitlement freshness, stale access will persist across human users and NHIs. Zero Trust programmes need explicit ownership for review, revocation, and audit response.
👉 Read our full editorial: Zero Trust identity governance is the core of modern security
