Topic starter
22/09/2026 3:43 pm
TL;DR: Identity security is no longer just about giving the right access at the right time, according to Saviynt's perspective, because attackers now exploit identity across humans, machines, and agentic AI while enterprises still organise controls around productivity-first IAM models. The governance gap is widening as machine identity, zero trust, and threat-aware decisioning become inseparable.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Why I Joined Saviynt - David Mahdi”.
Key questions
Q: What breaks when identity governance stays focused only on employees?
A: Blind spots open up around identities that are not tied to a person, including APIs, workloads, certificates, and agents.
Q: Why do service accounts and machine identities matter under NIS2?
A: Service accounts and machine identities matter because they often carry the permissions that move data, trigger reports, and feed AI workflows.
Q: How should security teams govern AI agents that can change actions at runtime?
A: Security teams should govern runtime AI by correlating identity, data, and intent before trusting an action path.
Practitioner guidance
- Embed threat signals into identity decisions Correlate identity events with suspicious behaviour, privilege anomalies, and access context so governance can respond to adversary activity, not just entitlement state.
- Inventory and assign ownership for NHIs Track service accounts, certificates, tokens, and API keys with named owners, business purpose, and renewal or revocation responsibility across environments.
- Rework reviews for runtime behaviour Assume that some identities, especially autonomous actors, may use access faster than periodic certification can observe it and move decision points closer to issuance time.
Bottom line: Identity security is moving from access enablement alone to threat-aware governance that treats identity behaviour as a security signal.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
This topic was modified 4 days ago 2 times by NHI Mgmt Group
22/09/2026 3:43 pm
Identity security is no longer a productivity-only discipline. The old IAM promise was to deliver the right access at the right time for business outcomes, and that remains necessary. But once attackers are actively targeting identity as an attack path, the governing question changes from access enablement to adversary-aware decisioning. The implication is that identity programmes now sit at the intersection of governance, detection, and trust validation.
A question worth separating out:
Q: How should security teams balance access enablement and identity control?
A: Security teams should treat access enablement as a delivery function and identity control as a governance function. The key is to provision quickly, then continuously validate whether access remains necessary, role-appropriate, and policy-compliant. Without that second layer, identity security becomes an illusion of productivity rather than a control over exposure.
👉 Read our full editorial: Identity security is shifting from productivity to threat-aware governance
This post was modified 5 days ago by NHI Mgmt Group