Insights · Field note · Security assurance and compliance
Identity and access monitoring: the controls that matter
Most breaches involve an identity. The handful of identity controls that detect and contain them are worth more than the rest of the stack.
Identity and access monitoring watches for the events that precede and accompany most breaches: new accounts and new administrators, privilege changes, logins from unexpected locations or impossible travel, MFA disabled or bypassed, dormant accounts reactivated, leavers whose access persists, and service accounts used interactively. The controls that matter are a complete account inventory, enforced MFA, timely de-provisioning, periodic access review with records, alerting on the events above, and a response when they fire. Everything else in identity is secondary to those.
In detail
What the evidence shows.
The events worth watching
Account creation, especially privileged. Group and role membership changes. Authentication from new countries or impossible travel. MFA registration changes and bypasses. Password resets outside the help desk process. Dormant accounts becoming active. Service accounts logging in interactively. Each is cheap to detect and expensive to miss.
The controls underneath
A complete inventory of accounts, including service, vendor and shared accounts, reconciled against people and systems. MFA enforced with no exceptions for the accounts that matter most. De-provisioning the day a person leaves. Access reviews where owners confirm each entitlement, with records. Without these, monitoring has nothing reliable to compare against.
What the records show
Access review records, de-provisioning records, MFA coverage reports and alert handling records are among the first things auditors, customers and insurers request. They are evidence that identity is governed, and they are produced by the controls operating.
Phishing-resistant authentication
Monitoring detects misuse; phishing-resistant MFA prevents the most common cause of it. NIST SP 800-63B and CISA guidance both describe the distinction. See planning the move to phishing-resistant authentication, identity and access monitoring and identity and access architecture.
Sources
Primary references.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days