Why do midsized organisations often struggle more with hybrid identity security?

Why This Matters for Security Teams

Hybrid identity security becomes harder as soon as an organisation has both legacy directory sprawl and cloud-native access paths in the same environment. The problem is not just more accounts. It is more trust relationships, more delegated administration, and more places where permissions drift without being noticed. NHI Management Group’s Ultimate Guide to NHIs shows how quickly service accounts, API keys, and automation identities multiply, while the NIST Cybersecurity Framework 2.0 reinforces the need for continuous identification, protection, detection, and response across the full identity estate.

Midsized organisations often feel this pressure more acutely because they are large enough to inherit fragmented identity patterns, but not large enough to maintain dedicated specialists for every directory, SaaS tenant, and privileged workflow. That gap means review cycles slip, trust settings remain over-permissive, and remediation queues build faster than teams can clear them. The result is a security posture that looks manageable on paper but decays in practice. In practice, many security teams encounter serious identity exposure only after a vendor account, service principal, or automation token has already been abused.

How It Works in Practice

Hybrid identity security breaks down when different control planes are managed as if they were separate problems. A common pattern is to protect the corporate directory well enough, while leaving cloud roles, SaaS admin rights, machine credentials, and federation settings under the stewardship of different teams. That creates blind spots across the full lifecycle: creation, delegation, review, rotation, and decommissioning.

Current guidance suggests treating all identities, human and non-human, as part of one governance model with different risk treatments. The 52 NHI Breaches Analysis and the Top 10 NHI Issues both highlight recurring failure patterns: excessive privilege, weak rotation, and poor visibility into where credentials are used. That maps directly to the practical work midsized teams need to prioritise:

• Inventory every identity source, including directories, cloud IAM, SaaS admins, service accounts, and API keys.
• Map who can grant access, not just who has access, because delegated administration is often where drift starts.
• Classify identities by business criticality and blast radius so review effort is focused on the highest-risk paths first.
• Automate credential rotation and offboarding where possible, because manual change windows do not scale.
• Use continuous logging and alerting for trust changes, federation updates, and privilege expansion.

For control design, NIST CSF 2.0 helps frame the work as a repeatable lifecycle rather than a one-time audit exercise, while the NHI guidance from Ultimate Guide to NHIs is especially useful for understanding why machine identities need tighter rotation and ownership than many human accounts. These controls tend to break down when identity ownership is split across infrastructure, application, and security teams because no single group sees the full dependency chain.

Common Variations and Edge Cases

Tighter identity governance often increases operational overhead, requiring organisations to balance stronger control against slower change velocity. That tradeoff is especially visible in midsized environments where a small team supports many business units, acquired systems, and cloud services. Best practice is evolving, but there is no universal standard for how quickly every identity should be reviewed; the right cadence depends on privilege level, exposure, and whether the identity can reach production or third-party systems.

Some environments also inherit edge cases that make the problem harder than a standard directory review. For example, federated SaaS applications may expose admin controls outside the main IAM platform, and DevOps pipelines may embed long-lived secrets in code, config, or CI/CD tooling. The practical issue is not only finding those identities, but proving ownership and establishing a revocation path when the associated team no longer exists or the application has been partially retired. When the same staff member wears multiple hats, approvals can become informal and exceptions can remain active long after their business justification has expired.

That is why hybrid identity security usually improves fastest when organisations define a minimum viable governance model: one inventory, one review standard, one rotation policy for high-risk secrets, and one escalation path for privileged exceptions. Without that discipline, midsized organisations tend to accumulate identity debt faster than they can retire it.

Related resources from NHI Mgmt Group

• Why do healthcare organisations struggle to get identity security fully operational?
• How should security teams normalize cloud logs for identity investigations?
• What do security teams get wrong about identity in Industry 4.0 programmes?
• How should security teams run entitlement reviews in hybrid environments?