18 Outdated Identity And Access Management Assumptions To Retire
At its core, identity and access management helps companies control who—or what—can access their systems and data. But as businesses adopt new technologies and authentication methods, keeping that access secure without making everyday work unnecessarily difficult is becoming more complicated.
The challenge isn’t just keeping up with new security technologies; it’s recognizing when familiar practices and long-held beliefs may be creating vulnerabilities. Below, members of Forbes Technology Council discuss outdated identity and access management assumptions tech leaders should reconsider as digital identities and authentication continue to evolve.
1. Verifying Users At Sign-Up Is Enough
Retire the idea that verifying someone once at sign-up is enough. Fraudsters are finding ways to take over established, verified accounts and exploit the trust those accounts carry. A one-time “yes” shouldn’t mean lifetime trust. Verification needs to be continuous, combining device and network signals, behavioral biometrics, and risk-based orchestration to assess risk over time and ensure trust extends beyond the initial onboarding moment. – Kaarel Kotkas, Veriff
2. Strong Authentication Guarantees Identity Security
We need to retire the assumption that strong authentication alone secures identity. As machines and AI agents gain access, organizations must limit privileges, detect unauthorized changes and restore trusted identities and access policies after an attack. Identity resilience keeps businesses running and enables rapid recovery when preventive controls fail. – Robert Bobel, Cayosoft
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
3. More Login Hurdles Mean Better Security
The assumption that more complex authentication always means stronger security is a myth. Every unnecessary login, password reset or access hurdle introduces friction for users, costing organizations productivity while encouraging risky workarounds. Security that employees routinely circumvent isn’t effective security. The goal should be to make secure access the easiest path. – Fran Rosch, Imprivata
4. Only People Have Digital Identities
Retire the assumption that identities are human. Non-human identities, from service accounts to AI agents, now outnumber employees and often hold standing, overprivileged access with no clear owner. Treat every NHI as a governed identity: Assign ownership, enforce least privilege and review access continuously. – Damon Tompkins, Pathlock
5. One Workload Equals One Actor
Giving a service its own identity addressed the assumption that identities are human, but that is no longer enough. An orchestrator, several sub-agents and ordinary application code can now act from inside the same process using the same credentials. The question is not whether the caller is authenticated. It is which of the things inside it decided to make the call. – Aviv Mussinger, Kodem
6. Trust Doesn’t Need To Change With Risk
Static trust is the identity assumption leaders should kill. In e-commerce, a customer browsing from a known device may pass frictionlessly, but a $5,000 refund, new device or delivery address change should trigger stronger verification. Risk-based access adjusts authentication to context and consequence. The payoff is lower fraud without sacrificing conversion. Adaptive identity is now part of enterprise resilience. – Sumit Srivastava
7. Identity Providers Are Always Available
Retire the assumption that the identity provider is always available. If it fails, staff may be locked out of incident response, payroll or customer systems just when they are needed most. Define a separate emergency path for a few critical actions, keep it isolated and monitored, and rehearse its use and shutdown. Resilience means proving both that ordinary access stops and that recovery remains possible. Test emergency access with the primary identity service offline. – Jagadish Gokavarapu, Wissen Infotech
8. Authentication Is Enough To Govern Access
The assumption technology leaders should retire is that authentication establishes durable trust. Identity and access management is becoming as much a governance discipline as a security one. Organizations need clear boundaries around what people, applications and agents are permitted to do, as well as the ability to ensure those boundaries continue to hold as conditions change. – Jay Bavisi, EC-Council
9. AI Agents Should Inherit Users’ Permissions
Retire the assumption that an agent should inherit the permissions of the person it acts for. I can delete every entry on my calendar and pull salary data from our HR system. An agent acting for me should start with zero access, with its own identity and limits, until someone deliberately decides what it may do. That way, when something breaks, we know which agent did it and who is accountable. – Linus Hakansson, Gravitee
10. Identity Management Is Solely An IT Problem
Who can access what is now a business risk decision, the same as financial controls. When a single stolen login can stop operations or expose customer data, it belongs on the leadership agenda. CEOs should know who owns identity in their company, how often access is reviewed, and how quickly it can be shut off when something goes wrong. – Asad Khan, TestMu AI
11. Administrators Need Permanent Privileges
One outdated assumption is that administrators usually need standing privileges. Privileges are not always needed and are not needed for every command. Permanent admin rights or access to service accounts are exactly what attackers hunt for. Just-in-time access, granted for a specific task and expiring automatically, makes a stolen admin account worth far less. If someone holds the keys to the kingdom all the time, 24/7, “just in case,” that convenience is being paid for with risk. – Dan Sorensen, Nexus Security Advisors
12. Phone Or Video Calls Can Verify Identity
As video and voice cloning rise, tech leaders must retire the assumption that they can verify identity over the phone or through a video conference. Instead, we have to start relying increasingly on technical signals that users are the persons they claim to be unless they are standing right in front of us. – Kevin Korte, Univention
13. Knowing Who’s Acting Is Enough To Grant Access
The next access management question isn’t “who”; it’s “why.” An AI agent can be fully entitled to a resource and still be doing something it shouldn’t. Behavior is a signal, but it only shows what already happened. Intent is the purpose behind the action. Instead of asking, “Can this agent access this?” leaders should ask, “What is this agent trying to accomplish, and should that happen?” Access should not be given without understanding intent. – Sumit Dhawan, Proofpoint
14. Occasional Credential Rotation Is Enough
The main assumption to rethink is how we manage credentials. The old-school practice was to generate credentials, which were rotated occasionally or stored in a vault. That approach assumed credentials would be used only occasionally and would remain largely static. Agents require us to rethink how we authenticate and authorize activity: It needs to be on a per-use basis. That means credentials must be generated just in time and/or there must be enforcement scoped on a per-action basis. – Alex Bovee, C1
15. A Trusted Device Proves An Action Is Authorized
Leaders must retire the assumption that device or network verification signals user intent. Possessing a registered device or passing a biometric check does not guarantee a human explicitly authorized the action, especially with the rapid rise of session hijacking and AI-driven prompt injection. Cybersecurity and identity management processes must evolve to continuously verify contextual user intent at the transaction level. – Mark Brown, The Mark of Security Ltd.
16. Disabling An Employee’s Login Ends All Access
Retire the assumption that disabling an employee’s login closes all access they set up. Include service accounts and AI agents in offboarding, reassign ownership, and revoke credentials the employee could retain so you do not leave machine access under a former employee’s control. – Kayode Faturoti, Breet
17. Traditional MFA Methods Prevent Account Takeovers
Assuming traditional multifactor authentication methods like SMS codes or push notifications guarantee safety is a dangerous misconception in modern security. Adversary-in-the-middle and push-fatigue tactics routinely bypass these basic controls to capture session tokens. To truly lower account takeover risk, organizations must eliminate shared secrets entirely and transition to domain-bound, phishing-resistant standards like FIDO2 and passkeys. – Neil Lampton, TIAG
18. One Login Is Enough For An Entire Session
Retire the idea that one login proves identity for an entire session. Access should be continuously evaluated using context, device trust and behavior. Authentication is becoming an ongoing process, not a one-time checkpoint at the front door. – Michael Gargiulo, VPN.com
About Author
