Topic starter
16/01/2026 3:40 pm
TL;DR: Traditional IAM becomes increasingly inadequate as cloud adoption, remote work, SaaS sprawl, and credential-focused attacks expand the identity attack surface, according to One Identity. Fragmented identity tools create seams that attackers exploit, so unified governance and just-in-time privilege become operational necessities rather than architecture preferences.
Editorial analysis by NHI Mgmt Group, based on content published by One Identity.
By the numbers:
- 42% of attackers go after credentials because they provide a direct path to valuable data and systems.
Key questions
Q: What breaks when identity governance is split between IAM, PAM, and secrets tools?
A: What breaks is the ability to see and revoke effective access as one chain.
Q: Why does poor visibility into SaaS and cloud accounts increase identity and data security risk?
A: Poor visibility creates blind spots in account ownership, access paths, and data handling, which makes it easier for unsanctioned apps, duplicate accounts, and sensitive uploads to persist.
Q: How should security teams reduce breach risk from stolen credentials?
A: Security teams should reduce credential lifetime, remove stale secrets from code and tooling, and make access revocation faster than attacker reuse.
Practitioner guidance
- Consolidate identity governance across fragmented tools Inventory where PAM, IGA, and access management are running separate policies, logs, and review cycles.
- Shorten privileged access windows with JIT Replace standing elevated access on critical paths with just-in-time privilege so access exists only for the task and only long enough to complete it.
- Map cloud and SaaS identities into one governance view Build an inventory that includes cloud apps, SaaS tenants, and third-party access paths alongside internal accounts.
Bottom line: Traditional IAM weakens when the organisation no longer has a single network edge to defend and identities become the main control surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 5:11 pm
Traditional IAM is failing because the perimeter assumption has already collapsed. The article describes a world where cloud, SaaS, and remote work have dissolved the idea that identity can be governed from inside a fixed boundary. That means access control is no longer about defending a network edge but about continuously governing identities across distributed trust zones. Practitioners should treat the identity layer itself as the perimeter.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 49% of IT professionals would prioritise improving privileged access management if the decision were theirs alone, according to Netwrix's 2023 Hybrid Security Trends Report.
A question worth separating out:
Q: Should organisations treat identity governance as a network problem or an access problem?
A: As an access problem. The network perimeter is no longer the main boundary, so the real control point is who or what can authenticate, elevate, and reuse access across distributed systems. That makes identity orchestration and privileged access governance central to the security model.
👉 Read our full editorial: Traditional IAM is obsolete when identities become the new perimeter