Topic starter
02/01/2026 11:30 am
TL;DR: Cloud-first estates are stretching identity governance across AD, SaaS, and hybrid systems, while manual reviews, static entitlements, and siloed processes leave stale access and blind spots behind, according to RSA Security. The governance problem is no longer review volume alone, but whether access data, remediation, and auditability can keep pace with enterprise sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Modern Identity Governance for the Cloud-First Enterprise”.
Key questions
Q: How should security teams implement user access controls across cloud and on-prem systems?
A: Start by defining the access decision you want to make, then map that decision to the right policy shape.
Q: Why do manual access reviews fail in cloud-heavy environments?
A: Manual reviews fail because permissions spread across too many systems and change too quickly for periodic certification to stay accurate.
Q: How do you know if identity governance is keeping pace with identity sprawl?
A: Look for evidence that access reviews, remediation workflows, and integrations still function across the full estate without manual stitching.
Practitioner guidance
- Normalize entitlement data across systems Build a single view of access across AD, cloud directory services, SaaS apps, and core business platforms so review decisions are based on comparable data.
- Automate repetitive certification decisions Use policy-driven approvals and AI-assisted reviewer suggestions for low-risk, repeatable access patterns, and reserve manual review for exceptions and unusual entitlements.
- Track stale access as a remediation KPI Measure how long outdated entitlements remain active after role changes or departures, and use that metric to test whether governance is actually reducing risk.
Bottom line: Cloud-first identity governance is under pressure because access sprawl turns isolated entitlements into an enterprise visibility problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:34 am
Cloud-first governance fails when access data remains siloed by application. The article shows that the real problem is not merely review fatigue, but the inability to compare entitlements across AD, SaaS, and hybrid platforms with different role structures. When governance tools cannot normalize access data, they cannot reliably identify entitlement drift or stale access. Practitioners should treat normalization as the precondition for every downstream governance action.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How can organisations tell whether access review is actually reducing risk?
A: Organisations should look beyond campaign completion and measure downstream removal, reopened exceptions, and the number of high-risk roles still present after review. If rejected access does not disappear from the target system, or if repeated cycles keep certifying the same excess entitlements, the programme is not reducing risk effectively.
👉 Read our full editorial: Modern identity governance for cloud-first enterprise access sprawl