Topic starter
23/03/2026 2:05 pm
TL;DR: Identity attacks now dominate, with 88% of web application breaches involving stolen credentials and 95% of enterprise permissions going unused, according to Oleria Security. Basic IAM cannot keep up with fragmented identity data, usage blind spots, and expanding non-human identities, so usage-aware governance has become the real control requirement.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “Identity security: why IAM alone won't cut it anymore”.
By the numbers:
- 88% of web application breaches now involve stolen credentials.
- Over 95% of enterprise permissions go unused.
Key questions
Q: What breaks when identity programmes only track permissions and not actual usage?
A: They miss dormant access, active abuse and stale entitlements that still look valid on paper.
Q: Why do unused permissions increase identity risk so much?
A: Because unused access is still real access, and attackers look for accounts that already have privileges they do not need.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Practitioner guidance
- Unify identity data across systems Aggregate identity, entitlement and activity data from IdPs, cloud platforms, SaaS applications and HR systems into one view so you can compare provisioned access with observed use.
- Measure real access usage Track last login, dormant accounts, never-used privileges and unusual access patterns so reviews are based on evidence instead of static permission lists.
- Extend governance to machine identities Inventory service accounts, API keys, bots and AI agents, then assign owners, usage monitoring and offboarding rules that match their operating model.
Bottom line: Identity security is replacing permission-only IAM because security teams need to know how access is being used, not just who was granted it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 7:20 pm
Identity security is now the control plane because permission state no longer explains risk. IAM can tell you who was granted access, but it cannot tell you whether that access is dormant, misused or silently expanding. That breaks the old assumption that provisioning data and security state are close enough for governance. The practical consequence is that identity programmes must be judged by what they can observe and revoke, not what they can list.
A question worth separating out:
Q: How do security teams know whether identity governance is reducing risk?
A: Look for shorter time from access change to visibility, fewer unmanaged entitlements, and faster completion of review and remediation cycles. If access risk remains unchanged after deployment, the programme may be reporting activity without changing control outcomes.
👉 Read our full editorial: Identity security is now the control plane for human and machine access