Topic starter
16/04/2026 7:08 pm
TL;DR: Project Glasswing shows AI can discover and exploit long-hidden vulnerabilities far faster than human teams can process reviews, tickets, and remediation, turning the identity execution gap from an operational delay into a security risk, according to Twine Security. The core issue is not visibility alone, but whether identity controls can execute fast enough to stay inside the threat window.
Editorial analysis by NHI Mgmt Group, based on content published by Twine Security: “The Threat Landscape Just Changed. Has Your Identity Program?”.
Key questions
Q: What breaks when identity programmes rely only on periodic governance reviews?
A: Periodic reviews often miss the state of access between certification cycles.
Q: Why does a visibility-heavy IAM programme still leave risk behind?
A: Because seeing the problem is not the same as closing it.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Measure identity execution latency Track the time between issue discovery, approval, and closure across reviews, ticket queues, and remediation workflows.
- Automate routine closure steps Shift repetitive identity actions such as access cleanup, stale entitlement handling, and ticket completion toward controlled automation, while keeping explicit human approval for exceptions.
- Reclassify backlog items by exposure time Prioritise findings based on how long they remain exploitable, not just severity labels or audit age.
Bottom line: AI-driven discovery compresses the time defenders have to act, so identity programmes that rely on slow human workflows now create exploitable exposure windows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
06/10/2026 9:39 pm
Identity execution speed is now a security control, not an operational preference. When AI can discover exploitable weaknesses faster than teams can process reviews and tickets, the relevant control is no longer whether a finding was logged. The relevant control is whether remediation can complete before the threat window closes. Practitioners should treat time-to-action as a governance boundary, not a service metric.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations decide whether to automate identity remediation?
A: Automate only where the system has enough context to make a safe, accountable choice. If ownership, dependency, or business impact is unclear, the system should route a decision, not execute blindly. The key test is whether automation can complete closure without creating hidden blast radius or approval debt.
👉 Read our full editorial: AI-driven identity execution gaps are becoming a security risk