Topic starter
22/01/2026 4:47 pm
TL;DR: As cloud, remote work and AI-driven systems dissolve the network perimeter, identity governance becomes the control plane for security by unifying access visibility, automating lifecycle management and surfacing risky entitlements, according to Omada Identity. The core failure is not just lack of control, but the assumption that access can still be managed at human speed in machine-speed environments.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “As Identity Becomes the New Security Perimeter, IGA Becomes Essential”.
Key questions
Q: What breaks when identity attack surface governance is missing?
A: When identity attack surface governance is missing, organisations lose control over which credentials, tokens, service accounts, and delegated paths are still active.
Q: Why do dormant accounts and excessive entitlements increase breach risk?
A: They extend the time and scope in which valid credentials can be abused.
Q: How can organisations tell whether identity governance is actually reducing risk?
A: Look for faster revocation, fewer orphaned identities, higher-quality ownership data, and review decisions grounded in usage evidence rather than static lists.
Practitioner guidance
- Map identity attack surface across all directories Consolidate identity data from HR, directories, cloud identity providers, SaaS applications and databases so security teams can answer who has access to what across the estate.
- Automate contractor and leaver deprovisioning Trigger revocation across cloud, SaaS and on-premises systems when employment or engagement ends, so orphaned accounts do not remain valid for months.
- Prioritise high-risk entitlement certification Use access reviews to flag excessive privileges, toxic combinations and role drift first, rather than treating all access as equally urgent.
Bottom line: Identity governance now functions as a control plane because modern attack surfaces are defined by access relationships, not only by network boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:33 am
Identity governance is no longer a downstream control, it is the control plane for the attack surface. The article is right to shift the conversation away from network boundaries and toward identity relationships because access now defines exposure more directly than the perimeter does. Security teams cannot govern what they cannot enumerate, and that makes visibility the prerequisite for every other identity decision. The practitioner conclusion is simple: if identity data is fragmented, the attack surface is already larger than the control plane.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Why do machine identities need different governance than human accounts?
A: Machine identities lack the human anchors that make access reviews reliable, such as managers, HR events, and predictable offboarding. Their ownership is often ambiguous, their usage is hidden inside workloads, and their permissions can expand quietly. Governance must therefore rely on evidence, accountability, and lifecycle controls built for systems, not people.
👉 Read our full editorial: Identity governance is now the control plane for attack surface