What breaks when organisations deploy ITDR without sufficient identity and access visibility?

Why This Matters for Security Teams

ITDR only works when identity coverage is broad enough to explain normal and abnormal access across SaaS, directory services, cloud platforms, and NHI estates. Without that baseline, anomaly detection becomes noisy, attack-path analysis misses hidden privileges, and incident response starts with incomplete evidence. The problem is not just human accounts. Service accounts, API keys, and tokens often sit outside the same visibility plane, which undermines the very detections ITDR is meant to improve.

NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, while 80% of identity breaches involved compromised non-human identities such as service accounts and API keys in the Ultimate Guide to NHIs. That gap matters because identity telemetry is the input to investigation, containment, and privilege review. If the inventory is incomplete, the outcome is usually delayed triage rather than confident detection. Current guidance also aligns with the OWASP Non-Human Identity Top 10, which treats identity sprawl and weak lifecycle control as core risk drivers. In practice, many security teams discover missing access paths only after a suspicious token, account, or cloud role has already been abused.

How It Works in Practice

Effective ITDR depends on three things: a complete identity inventory, high-quality authorization data, and telemetry that links accounts to actual usage. In practice, that means pulling data from directory services, SSO, cloud IAM, SaaS admin logs, PAM, and NHI platforms into one investigation workflow. The objective is not simply to count identities. It is to understand who or what can reach which systems, under what conditions, and with what privilege boundaries.

Security teams usually need to map access in layers. Start with the principal, then resolve nested group membership, inherited cloud roles, delegated admin rights, machine identities, and token-based access. That baseline is what enables meaningful ITDR functions such as:

• Detecting impossible or unusual access patterns against a known identity graph
• Tracing lateral movement from an initial compromise to downstream resources
• Separating legitimate automation from suspicious service-account activity
• Reconstructing privilege use during incident response

For non-human identities, the control problem is often sharper because the access path may be hidden in code, pipelines, or secrets stores rather than visible in a user directory. NHIMG’s NHI Lifecycle Management Guide is a useful reference for connecting inventory, rotation, offboarding, and visibility into one operational model. NIST also reinforces the importance of identity assurance, access control, and continuous monitoring in NIST SP 800-53 Rev 5 Security and Privacy Controls. These controls tend to break down when organisations run multiple identity systems with no shared ownership because attribution and privilege resolution become inconsistent across platforms.

Common Variations and Edge Cases

Tighter identity visibility often increases integration overhead, requiring organisations to balance faster detection against the cost of normalising fragmented data sources. That tradeoff is especially hard in hybrid environments, where different teams manage cloud IAM, AD, SaaS, CI/CD, and NHI secrets independently. There is no universal standard for perfect identity mapping yet, so current guidance suggests prioritising the accounts and paths that can create the largest blast radius.

One common edge case is machine-to-machine access that never appears in interactive login telemetry. Another is delegated admin or third-party support access, where the true effective privilege is higher than the logged role name suggests. A third is shadow identities created by automation, temporary projects, or developer tooling. If those are not tied back to an owner and a business purpose, ITDR will miss both normal usage and abuse. That is why the broader breach picture in 52 NHI Breaches Analysis is so instructive: attackers routinely exploit identity gaps rather than breaking perimeter controls first.

The practical takeaway is simple. ITDR degrades quickly when visibility is partial, but it degrades unevenly, with the biggest failure occurring where privilege is least observable and automation is most trusted.

Related resources from NHI Mgmt Group

• What breaks when organisations migrate AWS access management without aligning identity provider maturity and workflow design?
• What breaks when organisations deploy single sign-on without strong identity proofing?
• What breaks when organisations assume an external trust limits access to only two domains?
• What breaks when organisations rely on help desk resets to recover access?