Topic starter
16/01/2026 5:36 pm
TL;DR: 70% of organisations believe their identity security is mature, yet 80% lack complete visibility into active identity threats under exploitation, according to Silverfort citing Osterman Research. The maturity label is outpacing operational control, and that gap turns identity security into a measurable business risk rather than a perception problem.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “Identity Security Lacks Clear Standards, Creates Perception Gap in Actual Protection”.
By the numbers:
- 70% of organisations believe their identity security is mature, according to Silverfort.
- 80% admit they lack complete visibility into active identity threats under exploitation, according to Silverfort.
Key questions
Q: What breaks when identity security maturity is claimed without full visibility?
A: The claim breaks because maturity depends on seeing how identities are actually being used, not just on having IAM tools in place.
Q: Why do hidden service-account behaviours increase identity risk?
A: Because service accounts often carry broad, persistent access and operate quietly across systems where weak monitoring misses abnormal use.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Build a complete identity inventory See and track every human and non-human identity across cloud, SaaS, and legacy environments, then baseline normal behaviour for service accounts, tokens, API keys, and emerging AI agents.
- Separate identity security from IAM Create an independent identity security control plane that can detect misuse and lateral movement across directories, IDPs, and workloads rather than assuming IAM coverage is enough.
- Shift enforcement to authentication time Use risk-based step-up authentication, hard blocks on abnormal context, and ring-fencing for service accounts so suspicious access is constrained before it can spread.
Bottom line: Identity security maturity is being overstated when organisations cannot see what their human and non-human identities are doing in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
06/10/2026 11:48 pm
Identity maturity without complete visibility is a false control state. Organisations can have IAM, MFA, logging, and even privileged controls in place while still failing to see how identities are actually being used. That is not maturity, because mature control requires observable behaviour as well as policy intent. For NHIs and service accounts, the absence of behavioural visibility means the programme cannot prove what it protects. The practitioner conclusion is that maturity should be measured against what is observable in production, not what has been deployed on paper.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: Should teams prioritise visibility or autonomous remediation first?
A: Visibility comes first when the organisation cannot yet see identity behaviour clearly, because you cannot automate response to signals you do not have. Once coverage exists, autonomous remediation becomes the faster way to reduce blast radius and close the gap between detection and containment.
👉 Read our full editorial: Identity security maturity is outpacing visibility and control