Identity Security Posture Management, or ISPM, helps security teams understand and reduce identity risk before it becomes an incident. It focuses on visibility, ownership, excessive access, stale accounts, risky permissions, federation chains, and remediation progress.
Microsoft Entra ID. Its identities, roles, apps and settings keep the inventory current.Baseline · MFA coverage. 8Layers checks every identity against it, all the time.Finding. Three administrators can sign in with a password alone.Controls at risk. The same finding counts against ENS, NIS2 and SOC 2. Test once, comply with many.Enforce MFA. The fix is applied in Microsoft Entra ID, automatically or with one click.Re-evaluated. The baseline runs again on the updated inventory.Evidence recorded. The finding, the fix and the passing controls are on record for the audit.Okta. Its identities, roles, apps and settings keep the inventory current.Baseline · Inactive accounts. 8Layers checks every identity against it, all the time.Finding. Twelve accounts nobody has used in three months can still sign in.Controls at risk. The same finding counts against ENS, NIS2, ISO 27001 and SOC 2. Test once, comply with many.Suspend accounts. The fix is applied in Okta, automatically or with one click.Re-evaluated. The baseline runs again on the updated inventory.Evidence recorded. The finding, the fix and the passing controls are on record for the audit.Google Workspace. Its identities, roles, apps and settings keep the inventory current.Baseline · Third-party apps. 8Layers checks every identity against it, all the time.Finding. An app nobody approved holds access to company mail.Controls at risk. The same finding counts against NIS2, ISO 27001 and SOC 2. Test once, comply with many.Revoke app access. The fix is applied in Google Workspace, automatically or with one click.Re-evaluated. The baseline runs again on the updated inventory.Evidence recorded. The finding, the fix and the passing controls are on record for the audit.AWS. Its identities, roles, apps and settings keep the inventory current.Baseline · Credential hygiene. 8Layers checks every identity against it, all the time.Finding. A service account's access key has not been rotated in more than a year.Controls at risk. The same finding counts against NIS2, ISO 27001 and SOC 2. Test once, comply with many.Deactivate key. The fix is applied in AWS, automatically or with one click.Re-evaluated. The baseline runs again on the updated inventory.Evidence recorded. The finding, the fix and the passing controls are on record for the audit.Four baselines, one loop. Your directories keep the inventory current, 8Layers checks every identity against its baselines, each gap names the framework controls it puts at risk, the fix is applied back in the directory, and the evidence is on record for the audit.
Fixes are applied through each directory's own controls, automatically or with one click. Control mappings are 8Layers' own, and most frameworks also include controls that need manual evidence.
Four posture baselines in turn: MFA coverage in Microsoft Entra ID, Inactive accounts in Okta, Third-party apps in Google Workspace and Credential hygiene in AWS. Each is checked against an inventory of every identity; the gap it finds names the framework controls it puts at risk, the fix is applied back in the directory, the baseline runs again, and the evidence is recorded. Controls are mapped to ENS, NIS2, ISO 27001 and SOC 2.
The problem
Identity risk usually builds quietly.
Most identity risk is not dramatic at first.
A service account gets broad permissions during a migration. A user keeps admin access after changing roles. An OAuth token stays active after a project ends. An AI agent inherits more access than anyone intended. A federation path creates compound exposure across systems.
Individually, each issue may look small. Together, they create an attack surface.
ISPM gives teams a living view of that risk instead of a quarterly spreadsheet.
The module
What 8Layers Octagon does.
Octagon is the 8Layers module for identity posture, inventory, and risk scoring.
Discover service accounts, API keys, OAuth tokens, machine identities, and AI agents.
Map identity relationships across IdPs, cloud providers, SaaS, and federation chains.
Score risk based on configuration, permissions, access, and behavior.
Prioritize the identities that create the most exposure.
Guide remediation and track exceptions.
Preserve an audit trail for risk waivers and control evidence.
Posture risks
Posture risks ISPM should find.
Common identity posture issues include:
Excessive privileges
Stale accounts
Dormant accounts with active access
Unowned non-human identities
Weak or missing MFA controls
Service accounts with broad permissions
OAuth grants that are no longer reviewed
Federation trust chains that multiply exposure
AI agents without clear ownership or access boundaries
The goal is not to flood teams with findings. The goal is to show what matters first.
Where it fits
ISPM vs IGA, IAM, PAM, and ITDR.
How ISPM complements IAM, IGA, PAM and ITDR
Category
Primary job
Where ISPM helps
IAM
Authenticate users and manage access
Shows where access creates security exposure.
IGA
Govern access requests and reviews
Adds continuous posture and risk prioritization.
PAM
Manage privileged access
Finds privilege exposure across broader identity paths.
ITDR
Detect and respond to identity threats
Gives posture context before and during incidents.
ISPM is the connective tissue. It helps teams understand identity risk before a detection fires.
Every identity
ISPM for non-human identities and AI agents.
Non-human identities do not fit neatly into employee access reviews.
They may be created by applications, cloud services, pipelines, scripts, or AI workflows.
8Layers helps teams find these identities, assign ownership, understand access, and track remediation. That includes AI agents that act through tokens, service accounts, OAuth grants, or delegated permissions.
Evidence
Compliance value.
Compliance teams need evidence that identity controls work over time.
With 8Layers Compass, posture findings can connect to control evidence, exceptions, remediation history, and audit-ready reporting. That matters for frameworks such as ISO 27001, SOC 2, NIS2, and ENS.
ISO 27001SOC 2NIS2ENS
Buyer checklist
Ask any ISPM vendor.
Methodology. This page is based on 8Layers platform positioning and public category analysis reviewed in July 2026. It is written for security, IAM, and compliance teams evaluating ISPM platforms.
Seven questions to ask:
01Can you inventory human, non-human, and AI-agent identities?
02Can you map access across IdPs, cloud, SaaS, and federation chains?
03Can you calculate compound identity risk?
04Can you prioritize remediation based on exposure?
05Can you track risk waivers and exceptions?
06Can you connect posture findings to audit evidence?
07Can posture context support threat investigations?
Frequently asked questions
ISPM stands for Identity Security Posture Management. It helps teams discover, assess, prioritize, and reduce identity risks such as excessive access, stale accounts, weak controls, and unmanaged non-human identities.
ISPM focuses on reducing identity risk before incidents happen. ITDR focuses on detecting and responding to identity threats. The two work best together.
It should. Modern ISPM needs to cover service accounts, API keys, OAuth tokens, machine identities, workloads, and AI agents.
8Layers Octagon inventories identities, maps relationships, scores risk, prioritizes remediation, and tracks evidence across human, non-human, and AI-agent identities.
