Topic starter
23/03/2026 2:06 pm
TL;DR: Legacy IGA often takes 18 months or longer to deploy, while 95% of multi-cloud permissions remain unused and 72% of organisations have experienced or suspect an NHI breach, according to Oleria Security and NHIMG research. The governance problem is no longer access approval at the door, but continuous proof that access still matches role, usage, and risk.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “What is Identity Governance and Administration (IGA)?”.
Key questions
Q: What breaks when access reviews lack reviewer context?
A: Reviewers cannot distinguish legitimate access from unnecessary access if they only see a name and a checkbox.
Q: Why do organisations still end up with privilege creep even with IGA in place?
A: Privilege creep persists when access grants are easy but revocation is slow, manual or poorly tied to mover and leaver events.
Q: How should security teams govern non-human identities alongside human accounts?
A: Security teams should govern non-human identities as a separate lifecycle category with their own inventory, ownership, rotation, and offboarding controls.
Practitioner guidance
- Map access by lifecycle stage Classify identities by joiner, mover and leaver state, then separate human, service account and application access paths so governance events do not share one generic workflow.
- Add usage context to certifications Feed recent usage, peer comparison and role change data into review campaigns so approvers see whether access is still needed before they sign off.
- Inventory non-human identities alongside users Track service accounts, API keys and other non-human identities in the same governance model as employees and contractors so orphaned access does not sit outside review cycles.
Bottom line: Legacy IGA fails most visibly when organisations confuse access approval with ongoing access governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 7:19 pm
Access governance fails when review cadence is treated as proof of control. Periodic certification only works when the reviewer has enough context to make an informed decision. In modern estates, that context is fragmented across SaaS, cloud, on-premises systems and NHI inventories, so the governance signal degrades quickly. The practitioner implication is that governance must move from checkbox review completion to contextual decision quality.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations rely on IAM alone for identity governance?
A: No. IAM decides whether access is granted at the front door, but it does not keep proving that access still makes sense after the fact. Governance needs a separate control layer for certifications, entitlement management and lifecycle checks, otherwise access drift goes undetected.
👉 Read our full editorial: Identity governance in the AI era: why IGA still fails