Who should be accountable for improving identity security readiness across universities, employers, and training programmes?

Why Identity Security Readiness Cannot Be Left to One Institution

identity security readiness is a shared operational dependency, not a narrow academic issue. Universities shape baseline skills, training programmes translate theory into practice, employers define what “good” looks like in production, and security leaders decide whether those expectations become real controls. When those groups drift apart, practitioners enter the workforce knowing concepts but not how to govern secrets, privileged access, or NHI-heavy environments. The result is predictable: access risk shows up at the point of hire, onboarding, or incident response, not during curriculum design.

NHIMG research on the State of Non-Human Identity Security shows why this gap matters: only 1.5 out of 10 organisations are highly confident in securing NHIs, and Top 10 NHI Issues highlights how quickly credential sprawl and weak monitoring become operational problems. Identity readiness is therefore accountable to both capability builders and capability consumers. In practice, many organisations discover the readiness gap only after a bad onboarding, a leaked secret, or a privilege review that exposes how little the workforce was prepared for real identity risk.

How Accountability Should Work Across Universities, Employers, and Training Providers

Accountability should be distributed, but it should not be vague. Universities are responsible for baseline literacy: how identities are created, authenticated, authorised, rotated, and revoked, including the difference between human identity, NHI, and workload identity. Training providers should convert that baseline into hands-on practice with secrets hygiene, policy-as-code concepts, incident triage, and least privilege. Employers then own the operational standard by defining role expectations, measuring competency, and giving teams access to the environments where identity failures actually happen.

For security leaders, the practical task is to turn identity readiness into a measurable control objective rather than a hiring slogan. That means mapping job roles to required knowledge, evaluating candidates and staff against those requirements, and keeping curricula aligned to current threats. NIST’s SP 800-53 Rev. 5 Security and Privacy Controls remains a useful reference for translating readiness into governance, while Ultimate Guide to NHIs gives teams the vocabulary to distinguish workforce identity from machine identities and service accounts.

• Universities should teach identity fundamentals as a core security competency, not an elective topic.
• Training providers should include lab-based exercises on NHI lifecycle, secrets handling, and access review.
• Employers should define identity readiness in job descriptions, onboarding, and promotion criteria.
• Security leaders should verify that readiness maps to real control gaps, not just certification counts.

These controls tend to break down in organisations that treat identity as an IT admin function rather than a shared security discipline, because no single group owns the full lifecycle from education to production.

Where Shared Accountability Gets Hard in Practice

Tighter accountability often increases coordination overhead, requiring organisations to balance standardisation against local autonomy. Universities move slowly, employers move on quarter-based priorities, and training providers often optimise for broad market appeal rather than role-specific depth. That creates a real tradeoff: the more specific the identity security competency model becomes, the harder it is to maintain across different curricula and hiring pipelines.

Current guidance suggests the best answer is a tiered model. Everyone should understand identity basics, but only some roles need advanced capability in PAM, JIT provisioning, secrets rotation, or NHI governance. The operational mistake is to assume a general cyber curriculum automatically creates identity readiness. It does not. Breach analyses such as 52 NHI Breaches Analysis and practical cases like the JetBrains GitHub plugin token exposure show how weak identity hygiene becomes an enterprise issue quickly. The right accountability model is shared, but the metrics must be explicit: who teaches, who validates, who hires, and who enforces. That approach matters most where AI-enabled tooling, contractor access, and fast-moving environments make identity failure both easier and harder to detect.

Related resources from NHI Mgmt Group

• Who is accountable when identity security controls fail across IAM, PAM, and NHI programmes?
• Who is accountable for protecting identity data when access is granted across partners and internal business units?
• Who is accountable when AI risk, privacy, and security controls are managed in separate programmes?
• How should enterprises structure identity security operations across APAC and EMEA when they expand into multiple regions?