Why do organisations struggle to turn identity security awareness into measurable control improvement?

Why This Matters for Security Teams

Identity awareness often improves recognition, but not execution. Security teams can name the risks, yet still leave service accounts over-privileged, secrets embedded in code, and offboarding tied to ad hoc tickets rather than enforced control. That gap is especially visible for non-human identities, where volume, sprawl, and machine speed make manual oversight ineffective. NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is why awareness without lifecycle enforcement rarely changes outcomes. NIST’s Cybersecurity Framework 2.0 also makes clear that governance must translate into measurable, repeatable control activity.

The practical issue is ownership. Teams may understand that secrets should be rotated or that access should be least privilege, but they do not always assign responsibility, define evidence, or schedule reviews that prove the change stuck. As a result, awareness campaigns create alignment in theory while operational risk remains unchanged in production. In practice, many security teams discover this only after a leaked token or stale privilege has already been used to move laterally.

How It Works in Practice

Measurable improvement starts when identity security is treated as a control system, not a training topic. Awareness should feed inventory, policy, and review cycles. That means first identifying every human and non-human identity, then mapping its entitlements, secret locations, owner, business purpose, and rotation status. The most useful programs turn each of those items into evidence that can be audited over time, rather than a one-time spreadsheet cleanup.

A common operational pattern is:

• Inventory service accounts, API keys, certificates, and OAuth apps.
• Assign a clear business owner and technical owner for each identity.
• Enforce least privilege and remove standing access where possible.
• Automate secret rotation, expiry, and revocation on offboarding.
• Review exceptions on a fixed cadence and track closure rates.

This is where awareness becomes measurable. NHIMG’s Top 10 NHI Issues and the State of Non-Human Identity Security show why: lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, while monitoring gaps and over-privilege follow closely behind. That finding matters because it shifts the question from “Do people understand the risk?” to “Is the control actually being executed?”

Teams that mature fastest usually align identity work to explicit control objectives in frameworks such as NIST CSF, then measure completion rates for rotation, offboarding, and privilege reduction. Those metrics expose whether awareness is changing behaviour or just improving vocabulary. These controls tend to break down in fast-moving CI/CD environments because identities are created and consumed faster than review processes can keep up.

Common Variations and Edge Cases

Tighter identity control often increases operational overhead, requiring organisations to balance faster delivery against stronger governance. That tradeoff is real, especially where application teams rely on ephemeral environments, shared pipelines, or vendor-managed integrations. Best practice is evolving here, and there is no universal standard for every environment.

For example, rotating secrets too aggressively can disrupt fragile integrations if ownership is unclear, while rotating too slowly leaves long-lived credentials exposed. Similarly, fully manual approvals may satisfy policy but fail in practice when developers or platform engineers need near-real-time access. The better answer is usually contextual: short-lived credentials, automated expiry, and policy exceptions that are visible, time-bound, and reviewed.

Edge cases also appear when organisations believe awareness alone solves third-party risk. NHIMG’s 52 NHI Breaches Analysis shows that breach patterns often involve dormant permissions or exposed credentials that were known but not controlled. In other words, the hard part is not knowing that secrets are dangerous. The hard part is proving that ownership, revocation, and review happen every time, even when the environment is messy and the exceptions are constant.

Related resources from NHI Mgmt Group

• Why do IAM programmes still struggle to turn awareness into measurable control improvements?
• How should security teams turn cyber resilience awareness into stronger identity security programmes?
• How should security teams turn accountability into a measurable identity control?
• Why do identity teams struggle to turn Zero Trust into measurable control?