Identity Security Posture Management (ISPM) is the continuous practice of finding and fixing identity weaknesses before attackers can use them. It maps who and what has access to which resources, and shows where that access is excessive, outdated or poorly protected.

What does ISPM do?

It discovers identities across the environment, assesses their access and configuration, prioritises the risks that matter most and guides remediation. It keeps doing this continuously, because identities and access change every day.

What does ISPM find?

• Excessive and unused privileges.
• Dormant, orphaned and misconfigured accounts.
• Gaps in MFA coverage, especially on privileged accounts.
• Service accounts and API keys with broad, long-lived access.
• Access that has drifted away from least privilege.
• Paths that let a low-level account reach critical systems.

How does ISPM work?

1. Discover: build a map of identities, human and non-human, and their access.
2. Assess: compare access and configuration with good practice and with what is actually used.
3. Prioritise: use risk-based prioritisation to rank findings by how much an attacker could gain.
4. Remediate: remove, reduce or protect access, with clear owners.
5. Monitor: keep checking, so that drift is caught early.

What is risk-based prioritisation?

Environments contain thousands of findings, and not all are equal. Risk-based prioritisation ranks them by the damage they allow, for example a privileged account without MFA that reaches a critical application comes before a dormant account with no access.

How is ISPM different from IAM and IGA?

IAM manages access and IGA governs it through requests and reviews. ISPM checks the result, continuously, and shows where the access that exists no longer matches what is needed or safe.

How is ISPM different from ITDR?

ISPM works before an attack by reducing exposure. ITDR works during an attack by detecting and responding to misuse. They answer different questions, how exposed are we and is something happening now, and they work best together.

What are the limits of ISPM?

Posture cannot catch behaviour that has not happened yet. An attacker using a valid account in a way that looks legitimate will not appear in a posture review. That is why prevention needs detection alongside it.

What does an ISPM finding look like?

A service account has domain administrator rights, a password that never changes and no activity for a year. ISPM flags it, shows what it can reach and who owns it, and recommends removing or narrowing its access.

Which identities does ISPM cover?

Employees and privileged accounts, and also non-human identities such as service accounts, API keys and AI agents, across on-premises directories, cloud platforms and SaaS applications.

What should you measure?

• Privileged accounts, and whether each has an owner.
• The share of privileged accounts protected by MFA.
• Dormant and orphaned accounts.
• Permissions that have not been used.
• The time taken to fix critical findings.

How does ISPM relate to blast radius?

Each finding that ISPM fixes shrinks the blast radius of an identity. The more access is reduced, the less an attacker can do with a single stolen login.

How does ISPM support compliance?

NIS2 and DORA expect organisations to control and justify access to critical systems. ISPM supports monitoring and alignment by showing who has access to what, what has changed and what has been fixed, without manual collection before every audit.

Sharelock provides ISPM as a native part of one platform, so risk found in posture informs detection and what detection learns improves posture.

‍