Topic starter
28/05/2026 11:37 am
TL;DR: Identity now sits in the center of breach paths, with Saviynt citing EY’s view that 90% of breaches involve identity through lateral movement and privilege escalation while AI compresses time-to-exploit and non-human identities outnumber people. That makes identity governance a core control plane for security, not just a compliance function.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “EY's Ayan Roy on why identity security is now the foundation of defense in depth”.
Key questions
Q: What breaks when identity security is not integrated into defence in depth?
A: Without identity security, zero trust has nothing to enforce, detection tools lose context, and attackers can move laterally using valid access paths.
Q: Why do AI-accelerated exploits change identity security risk so quickly?
A: AI shortens the time between disclosure and a usable exploit, which means defenders lose the buffer they used to rely on for coordinated patching.
Q: What do security teams get wrong about vendor certifications?
A: They often treat certification as proof that the vendor is safe in every context.
Practitioner guidance
- Strengthen identity as a detection signal Feed identity events into endpoint detection and SIEM so lateral movement and privilege abuse can be correlated in time, not after the fact.
- Review standing privilege first Prioritise accounts and entitlements that remain permanently enabled, because those are the most likely paths for escalation and reuse across systems.
- Rework certification success criteria Measure access reviews by the percentage of entitlements removed, not by whether the campaign was completed on schedule.
Bottom line: Identity controls are now central to defence in depth because they determine whether access policy can actually be enforced across systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
This topic was modified 3 days ago 2 times by NHI Mgmt Group
28/05/2026 11:41 am
Identity security has become the enforcement layer that makes defence in depth real. The article is right to frame identity as more than an access administration function, because every other control layer depends on it being correct. Zero trust, endpoint detection, and cloud policy all collapse if the identity layer cannot express and enforce who should have access. The practitioner implication is that identity governance now sits in the security architecture, not beside it.
A question worth separating out:
Q: How should organisations govern non-human identities alongside employee access?
A: Organisations should govern NHIs with the same discipline used for human access, but with stronger lifecycle ownership and expiry controls. That means inventorying service accounts, tokens, certificates, and agents, assigning business ownership, and tying every entitlement to a documented purpose. Governance is incomplete if machine access cannot be approved, certified, and removed on demand.
👉 Read our full editorial: Identity security is becoming the foundation of defense in depth
This post was modified 5 days ago by NHI Mgmt Group