Identity Is the Front Door: Why Access Management Cannot Be a Once-a-Year Exercise

Identity management is one of the most important and most neglected areas of IT security in mid-sized organisations. The reasons are understandable. It is not dramatic. It does not generate headlines until something goes wrong. And the tooling has historically been expensive and complex to implement.

The result is that most organisations have identity environments that have grown organically over years — access rights accumulated, never reviewed, with former employees in systems they should have left long ago, contractors with broader access than their work requires, and service accounts with privileged access that nobody fully understands.

Why identity is the front door

The majority of significant breaches involve compromised identity at some point in the attack chain. Not because firewalls failed or endpoint detection missed something — but because an attacker obtained credentials that gave them legitimate-looking access. Once inside with valid credentials, the attacker looks like a user. Traditional perimeter security does not help.

This is why the principle of least privilege matters so much in practice. Not as a compliance checkbox but as a genuine constraint: every user, every service account, every system should have only the access it needs for the work it does — no more. Implementing this thoroughly is tedious. Maintaining it over time without automated help is nearly impossible.

What continuous identity management looks like

Continuous identity management means access rights are reviewed not once a year in a spreadsheet exercise, but continuously — automatically flagging anomalies, surfacing access that has not been used in 90 days, alerting on privilege escalation, and prompting human review when something needs a judgment call.

The practical pieces look like this. Joiner-mover-leaver workflows that actually execute — when HR marks someone as left, the deprovisioning happens automatically, not when someone in IT remembers to do it. Access certification campaigns that run on a schedule, with AI surfacing the riskiest accounts first so human review time goes where it matters. Privileged account discovery that finds service accounts with admin rights that nobody knew existed.

The cost of doing nothing

The organisations that get this wrong do not usually suffer a dramatic breach. They suffer a slow accumulation of risk that surfaces at the worst possible moment — during a compliance audit, after a security incident, or when a new IT manager arrives and asks why 40% of the accounts in Active Directory belong to people who left the company.

The cost is not just security. It is also operational drag. People with too much access spend time in systems they should not be in. Service accounts that nobody understands become ticking time bombs — they do not expire, they do not get audited, and when one is compromised, the blast radius is enormous because it has admin rights across multiple systems.

How Claritam approaches this

Claritam’s identity management module is built on the continuous model. It does not replace your directory — it watches it. It flags dormant accounts, detects privilege escalation, surfaces orphaned service accounts, and generates review tasks for a human to approve or act on. The AI does the discovery and flagging. The human makes the call.

This connects to the broader platform. Identity is one piece of the picture — asset visibility is another, patch status is another. The point is that none of these things live in isolation. Access management, asset management, and patch management are all parts of the same environment, and managing them together gives you a picture that is actually true.

Claritam is developed by Hayshack Enterprises — the same team behind Greg Hay’s cybersecurity advisory practice. For the advisory side of identity management — what the findings mean, how to prioritise remediation — Greg works with South African organisations directly.

The South African context

In South African mid-market organisations, identity management has a particular shape. Many businesses run hybrid environments — Active Directory on-premises, Microsoft 365 in the cloud, and a growing collection of SaaS applications that each have their own user directories. Identity is fragmented across three or four platforms, and nobody has a single view of who can access what across all of them.

POPIA adds a legal dimension. The Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA) adds another. Both require that you can demonstrate control over who accesses personal information. An access review that says “we think everything is fine” is not control. An automated system that flags every dormant account, every excess privilege, and every orphaned service account — that is control.

The good news is that the tools to do this are more accessible than they have ever been. You do not need a six-figure identity suite. You need continuous monitoring, flagging, and human review of the exceptions. That is what the audit that nobody actually does looks like when it runs every day instead of once a year.