Topic starter
16/04/2026 7:06 pm
TL;DR: Hybrid work amplified access sprawl, dormant accounts, third-party credentials, and lateral movement risk, and RSA Security’s updated analysis argues that identity governance and administration must close the post-authentication gap before those permissions compound into breach paths. The governance challenge is no longer proving identity at login, but continuously proving access is still justified.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Identity Governance and Zero Trust: How to Secure Hybrid Workplaces”.
Key questions
Q: What breaks when hybrid access is provisioned quickly but never reviewed?
A: Entitlement drift breaks the governance model.
Q: Why do dormant accounts increase breach risk in hybrid workplaces?
A: Dormant accounts are risky because they preserve valid access after the user has left or changed roles.
Q: What are the signs that manual data access governance is failing in a hybrid environment?
A: Common warning signs include fragmented visibility, slow access reviews, unclear ownership of entitlements, and inconsistent least-privilege enforcement across platforms.
Practitioner guidance
- Tighten post-authentication governance Make access reviews, entitlement changes and de-provisioning part of the zero-trust control set, not separate IAM admin tasks.
- Eliminate dormant account exposure Create a hard process for accounts that remain active after role change, contractor exit or employee departure.
- Unify entitlement visibility Consolidate identity data from cloud, on-premises and SaaS directories so access reviews are based on one current view of permissions.
Bottom line: Hybrid workplaces create post-authentication governance gaps that authentication alone cannot close.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:56 pm
Post-authentication governance is the control plane zero trust cannot skip. Hybrid workplaces expose a simple but persistent weakness: authentication is treated as the end of the access decision, when it is really the start of it. Once identity is verified, the governance question becomes whether the entitlement still matches role, context and business need. Practitioners should treat access review and de-provisioning as part of the trust decision, not a downstream administrative task.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How does zero trust change the way teams should think about identity, access, and breach prevention?
A: Zero trust shifts security away from implicit trust and toward continuous verification of users, devices, and access requests. In practice, that means identity controls become central to every access decision, not just login. When paired with IAM, zero trust helps reduce the blast radius of compromised credentials and improves breach resilience across the organisation.
👉 Read our full editorial: Zero trust identity governance gaps in hybrid workplaces