Topic starter
16/01/2026 3:41 pm
TL;DR: Compliance frameworks alone do not stop breaches when organizations remain over-privileged, under-instrumented, and stuck in break-fix security, according to One Identity. The practical shift is from box-ticking governance to identity-led prevention, because digital identity now determines whether policy becomes control or theatre.
Editorial analysis by NHI Mgmt Group, based on content published by One Identity: “Compliant until breached: The case for Digital Identity”.
Key questions
Q: What breaks when compliance processes become box-ticking exercises?
A: Access governance stops reflecting actual risk.
Q: Why do over-privileged identities increase breach impact?
A: Over-privileged identities expand the damage a stolen credential can do because the attacker inherits more pathways into sensitive systems.
Q: How should organisations measure whether identity governance is actually working?
A: Organisations should measure whether governance reduces incident cost, manual workload, and time to detect or contain risky access.
Practitioner guidance
- Audit standing privilege across core identity estates Map where access persists without active business need across directories, cloud services and privileged accounts, then classify which roles or accounts are driving the most exposure.
- Replace approval-first reviews with evidence-based certification Require reviewers to see actual access scope, recent usage and ownership context before approving any entitlement, so access reviews test reality instead of confirming formality.
- Use identity bulkheads to limit lateral movement Separate critical administrative domains and reduce shared pathways so a compromised credential cannot move freely across systems with different risk profiles.
Bottom line: Compliance frameworks do not reduce breach risk if access reviews, approvals and certifications leave over-privileged identities untouched.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 5:09 pm
Compliance becomes theatre when identity is not the enforcement layer. The article is right to separate policy existence from operational control. If access reviews, approvals and framework checklists do not change who can actually do what, then the organisation has compliance evidence, not security enforcement. The practical conclusion is that IAM and PAM must be judged by control effect, not document completion.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Identity threat detection and response focuses on spotting and containing misuse after an identity is abused, while preventive controls try to stop access before it happens. In practice, ITDR watches for suspicious identity behavior, token abuse, and lateral movement signals that pass initial defenses. It works best when paired with strong access governance, logging, and rapid containment procedures across critical systems.
👉 Read our full editorial: Digital identity controls can reduce the compliance paradox