Visibility First

Expanded Definition

Visibility first is not a control by itself; it is the sequencing discipline that makes controls accurate. The approach begins with discovering what actually exists in the environment, including applications, identities, OAuth grants, service accounts, and access paths, before designing governance rules around them. In SaaS-heavy estates, this matters because the real inventory is often fragmented across tenants, teams, and delegated integrations, while the risk model built on assumptions will miss shadow IT and stale access. NHI Management Group treats visibility as the prerequisite for least privilege, lifecycle enforcement, and reliable offboarding. That maps cleanly to control thinking in NIST SP 800-53 Rev 5 Security and Privacy Controls, where access control and auditing depend on knowing what is present and who can use it. Definitions vary across vendors on whether visibility first is a program, a phase, or an operating principle, but the practical meaning is consistent: do not harden what has not been discovered. The most common misapplication is treating spreadsheet inventories as authoritative, which occurs when teams assume manually collected records reflect live SaaS entitlements and active machine access.

Examples and Use Cases

Implementing visibility first rigorously often introduces an initial discovery burden, requiring organisations to trade speed of policy rollout against the accuracy needed to govern real access. In practice, that tradeoff is usually worth it because policy built on incomplete data creates false confidence.

• Mapping all SaaS tenants and delegated apps before writing an offboarding workflow for departing employees.
• Discovering which service accounts still authenticate to production systems before setting rotation intervals.
• Identifying dormant OAuth grants that can silently retain access long after a team believes an app is retired.
• Using a current NHI inventory to separate sanctioned automation from unmanaged shadow integrations, a problem discussed in the Top 10 NHI Issues.
• Comparing discovered access paths against baseline identity controls so governance decisions are based on actual entitlements, not assumptions.

For deeper operating context, the lifecycle lens in the NHI Lifecycle Management Guide is useful because visibility is what makes onboarding, rotation, and decommissioning measurable rather than aspirational.

Why It Matters in NHI Security

Visibility first matters because NHI risk usually scales faster than governance maturity. NHIs outnumber human identities by 25x to 50x in modern enterprises, and NHI Management Group research shows only 5.7% of organisations have full visibility into their service accounts. That gap is not cosmetic. It means privileged automation, API keys, and third-party access can persist outside normal review cycles, especially in SaaS environments where access is granted through delegated apps and user-led experimentation. Without discovery, teams cannot reliably enforce least privilege, detect over-scoped access, or prove that stale credentials have been removed. The result is a control stack that looks complete but fails under audit or incident response. The same problem appears in environments with high secret exposure, where the inventory is too incomplete to support remediation prioritisation. Visibility first is therefore a governance prerequisite, not a nice-to-have operational preference. Organisations typically encounter the full cost of this blind spot only after an account takeover, cloud breach, or suspicious OAuth abuse, at which point visibility becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Should organisations prioritize visibility or least privilege first for AI agents?
• How should security teams scope their first NHI visibility rollout?
• What should organisations prioritise first in an IGA programme, visibility or workflow automation?
• What breaks when supplier visibility stops at the first tier?