Who is responsible for reducing identity-related cyber risk across the organisation?

Why This Matters for Security Teams

Reducing identity-related cyber risk is not just an IAM or SOC problem. It is a shared operating issue across security, IT, application owners, and business leaders because identities are now the control plane for access, automation, and sensitive data flow. When governance is weak, attackers do not need to “break in” so much as reuse trusted identities, secrets, and permissions to move laterally and act as legitimate users.

That is why identity risk has become a board-level resilience issue, not a back-office configuration task. NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is a strong indicator that responsibility cannot sit with one team alone. The right question is who owns policy, who operates controls, and who is accountable when access is granted, used, and revoked. NIST’s Cybersecurity Framework 2.0 reinforces that governance and risk outcomes depend on coordinated roles, not isolated tools. In practice, many security teams discover identity-related exposure only after a service account, API key, or user account has already been abused.

How It Works in Practice

Responsibility is usually distributed by function, but it must be orchestrated through a clear operating model. Security defines policy, baseline controls, and exception handling. IT and platform teams implement authentication, provisioning, patching, and lifecycle automation. Application and data owners approve access based on business need. Managers and employees reduce risk through day-to-day behaviour such as phishing reporting, MFA use, device hygiene, and prompt revocation requests when roles change.

For human identities, this usually means strong authentication, least privilege, and periodic access review. For non-human identities, it also means lifecycle discipline for secrets, API keys, certificates, and service accounts. NHIMG’s Top 10 NHI Issues and 52 NHI Breaches Analysis show why: compromised identities often persist because revocation is slow, ownership is unclear, or credentials are embedded in code and pipelines. Current guidance suggests mapping each identity to a named business owner and a technical custodian so that no account exists without accountability.

• Security sets policy for MFA, passwordless where appropriate, secrets handling, and privileged access controls.
• IT and engineering teams automate joiner, mover, leaver, and offboarding workflows.
• Business leaders approve risk tradeoffs when access is exceptional or time-sensitive.
• Employees and contractors report suspicious prompts, lost devices, and unexpected access requests immediately.
• Identity telemetry should feed monitoring so unusual access patterns can be investigated early.

CISA’s cyber threat advisories remain useful for validating current attacker tactics against identity systems, but execution still depends on local ownership and operational discipline. These controls tend to break down in highly federated organisations where business units can create identities, grant exceptions, or store secrets without a single accountable owner.

Common Variations and Edge Cases

Tighter identity governance often increases administrative overhead, requiring organisations to balance speed against assurance. That tradeoff becomes most visible in cloud-first environments, developer platforms, and partner integrations where access must change quickly and business teams resist friction. Best practice is evolving, but there is no universal standard for when a business owner can approve access alone versus when security must mandate it.

Shared responsibility also looks different for contractors, vendors, and machine identities. External users may be governed through procurement and third-party risk processes, while NHIs need technical ownership, rotation, and revocation controls that are much more automated than human access reviews. Where privileged access management is mature, responsibility is clearer because access is time-bound and auditable. Where it is not, teams often rely on informal trust and stale entitlements that linger long after the original business need has passed.

For organisations dealing with AI agents or autonomous workflows, responsibility becomes even more sensitive because identity decisions can be made at runtime and at machine speed. That is where role-based assumptions start to fail and policy enforcement must be tied to context, intent, and workload identity. The practical lesson is simple: identity risk reduction is everyone’s job, but control ownership must be explicit or it will be owned by no one.

Related resources from NHI Mgmt Group

• How should security teams reduce identity risk when access is spread across multiple systems and policies are applied inconsistently?
• Who is accountable for reducing identity blind spots across IAM, PAM, and IGA tools?
• How should organisations expand privileged access management across multiple regions without increasing identity risk?
• When does secret exposure become a broader identity risk?