Topic starter
25/08/2026 6:11 pm
TL;DR: Security operations now depend on effective permissions, not just authentication, according to Veza. That shift matters because containment fails when teams cannot map blast radius fast enough or prove least-privilege changes with audit evidence, and Veza positions its Access Graph, Access AI, VQL, and Actions as the operational layer for finding, interrogating, and changing access across human and non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Veza for Security Operations: Make Identity Operational”.
Key questions
Q: How should security teams use effective permissions in incident response?
A: Teams should resolve effective permissions first, then make containment decisions based on reachable data and actions rather than on directory membership alone.
Q: Why do service accounts and workloads increase blast radius so quickly?
A: They often carry persistent or inherited access across multiple systems, so one compromised identity can expose many resources at once.
Q: What signs show that identity security posture management is not operational?
A: The clearest signs are slow blast-radius mapping, manual approval bottlenecks, and remediation records that do not line up with the access change that actually happened.
Practitioner guidance
- Map effective permissions before containment Require incident responders to resolve inherited rights, ACLs, and role-based paths before revocation decisions are made.
- Separate fast triage from precise querying Use rapid natural-language investigation for first-pass scoping, then pivot to path-aware queries when you need evidence on specific entitlements.
- Link access findings to governed change Route scoping, revocation, approvals, and owner notification through ITSM or SOAR so the containment step produces an auditable record.
Bottom line: Identity security becomes operational when teams can turn permissions data into containment decisions instead of treating it as a reporting artefact.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
25/08/2026 6:11 pm
Identity security is becoming a control plane because effective permissions, not authentication alone, decide operational risk. The industry still talks about login events as though authentication were the main boundary, but most material damage happens after access is granted and inherited. That means SOCs need an operational model that can answer who can do what, on which object, with what evidence. The practitioner conclusion is clear: access truth must sit inside the response workflow, not beside it.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How do security operations teams contain identity-led incidents without losing audit evidence?
A: They should route every scope reduction through approved change workflows, attach the access rationale, and preserve the before-and-after entitlement state. That keeps containment defensible for auditors and useful for post-incident hardening. Without that evidence chain, the team may recover access but lose governance.
👉 Read our full editorial: Veza’s secops model reframes identity security as a live control plane
This post was modified 3 days ago by NHI Mgmt Group