Topic starter
02/01/2026 11:29 am
TL;DR: Periodic reviews can miss active identity abuse, RSA Security says, when manual workflows and disconnected controls only prove audit evidence. Governance needs continuous visibility and contextual signals to catch privilege misuse before certification cycles pass.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Compliance Isn’t Security: Why Identity Governance Needs a Risk Lens”.
Key questions
Q: Why do compliance-focused governance programmes still miss identity-based attacks?
A: Because compliance tells you that controls existed, not that they were timely enough to stop abuse.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Q: What breaks when governance relies only on quarterly access reviews?
A: Quarterly reviews miss the day-to-day drift that accumulates between certification cycles.
Practitioner guidance
- Prioritise access reviews by risk signal Move away from flat quarterly certification queues and rank reviews by user risk, sensitive system access, and anomalous context.
- Add behavioural context to governance decisions Use location, device, and time of access as governance inputs so reviewers see whether access is ordinary or suspicious.
- Map toxic combinations before certification cycles Identify separation-of-duties conflicts and privileged access combinations continuously, not after evidence has already been packaged for audit.
Bottom line: Compliance evidence alone does not prevent identity-based abuse when access reviews are periodic and manual.
Glossary terms: Identity Security Posture Management, Risk-Based Identity Governance, Toxic Risk Combinations, Segregation of Duties
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 3:32 am
Compliance-first governance leaves a security gap by design: A certification process can prove that access was reviewed, but it cannot prove that access was safe when it mattered. RSA Security's point is that audit evidence and exposure reduction are not the same outcome, and treating them as equivalent creates blind spots in modern identity programmes. Practitioners should separate proof of review from proof of risk control.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should financial institutions use identity governance for DORA and NIS2 compliance?
A: They should use identity governance as the evidence layer for access approval, review, and removal. The practical goal is to show that every entitlement has an owner, a business reason, and a lifecycle path. That makes compliance traceable and reduces the chance that stale access becomes an audit finding or operational weakness.
👉 Read our full editorial: Identity governance needs a risk lens, not a compliance lens