Topic starter
23/03/2026 2:00 pm
TL;DR: Cloud-native teams now need identity governance and administration that can keep pace with daily permission changes, because static roles and periodic reviews leave standing privilege behind, according to Apono. That shift makes time-bound access, automated revocation, and real audit evidence the practical baseline for modern NHI governance.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Top 10 Identity Governance and Administration Solutions”.
By the numbers:
- Third-party involvement in breaches doubled to 30% over the last year, which the article links to scattered access decisions across vendors, apps, and infrastructure.
Key questions
Q: What breaks when identity governance depends on quarterly cycles?
A: Quarterly cycles break the assumption that access state stays stable long enough to review it later.
Q: Why do third-party access paths increase identity risk across enterprise programmes?
A: Third-party access paths increase identity risk because they often rely on tokens, OAuth grants, API keys, and service accounts that sit outside the normal employee lifecycle.
Q: How do security teams know if just-in-time access is actually working?
A: Look for short-lived sessions, automatic revocation, and complete request-to-access logs.
Practitioner guidance
- Implement time-bound access for temporary work Apply expiry to access granted for incidents, vendor tasks, and short-lived operational work so permissions do not remain after the task ends.
- Separate third-party access from standing internal roles Track vendor, contractor, and partner access as distinct governed lifecycles so external permissions can be reviewed and removed without affecting employee access.
- Automate deprovisioning on role change and task completion Use workflow triggers to revoke access immediately when an assignment ends, not during the next review cycle, especially for cloud, data, and CI/CD entitlements.
Bottom line: Cloud-native identity governance breaks down when access changes faster than static roles and periodic reviews can track.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
06/10/2026 9:01 pm
Cloud-native IGA fails when governance is still treated as a snapshot problem. Static roles and quarterly certifications were designed for slower permission change. They break down when cloud teams create, modify, and retire access continuously across infrastructure, SaaS, and data systems. The practitioner conclusion is simple: governance must follow the rate of change, not the calendar.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise just-in-time access over broad access reviews?
A: Yes, when the objective is to reduce active exposure rather than just document it. Access reviews tell you what exists, but just-in-time access changes how long privilege exists in the first place. For high-risk permissions, reducing standing access usually delivers faster risk reduction than another review cycle.
👉 Read our full editorial: Identity governance for cloud-native teams still lags access change