When did someone at your company last lose an access right?
Granting is routine. Revoking almost never happens, and that's where risk piles up.
Not six separate problems. It's a chain reaction.
One root cause: access is granted and never reassessed. In isolation, the symptoms look harmless. Together, they form the fraud surface.
No policy
Grants with no written rule or owner.
Roles bloat
Every move adds access.
Conflict emerges
Incompatible SoD combinations.
Door left open
Failed offboarding keeps access alive.
Nobody reviews
Certification doesn't happen.
Silent exception
Abuse goes unnoticed.
Losses grow in silence. It's a curve, not an event.
Access granted
The conflict is born with the grant. No alarm for accumulated duties.
Role accumulates
Moves add permissions; reviews don't happen.
Exploitation possible
Create, approve and pay in one user: fraud is possible and silent.
Loss locked in
Median time to detection. Diversion, litigation, fines and reputation.
5% of annual revenue lost to fraud · 32% due to control failures · LGPD fines up to R$50M. Sources: ACFE, Report to the Nations 2024 · Law 13,709/2018, Art. 52.
Three workstreams. From the conflict to the process that creates it.
All three, end to end, in up to 6 weeks per system in scope.
SoD assessment
- SoD matrix with incompatibility rules
- Real user-level conflicts
- Impact × likelihood rating
- Compensating controls
Role optimization
- Role mining on actual usage
- Redundant, orphan and overlapping roles
- Minimal model per job
- Conflict removed at source
IAM process review
- Lifecycle: joiner, mover, leaver
- Grant, approval, review, revocation
- Governance, roles and KPIs
- Automation roadmap
What usually shows up.
The first objective view of real risk
Dozens of critical SoD conflicts, hundreds of exposed users and months of active orphan access.
Surface cut in half
No formal SoD matrix and 60%+ overlapping roles; −50% permissions after optimization.
Access as a price variable
Access deficiencies quantified with remediation cost, direct input to the negotiation.
Order-of-magnitude values, a recurring pattern observed by the team, not a specific client measurement.
Each artifact turns a blind spot into a possible decision.
| Deliverable | Before | After |
|---|---|---|
| SoD matrix | Conflict rules in a few people's heads | Incompatibilities formalized per system |
| Conflict inventory | "There must be some conflict somewhere" | Named list with source evidence |
| Risk map | Every finding looks equally urgent | Prioritized by impact × likelihood |
| Target role model | Roles grow with no design | Minimal catalog per business function |
| IAM assessment | Undocumented access process | Mapped lifecycle + automation roadmap |
| Treatment plan | Findings with no order of action | Sequence with quick wins and owners |
AS-IS maturity vs. benchmark, illustrative deliverable example.
Each technology and when to use it.
Access Control
To set the rule: who can do what, under which criteria.
AM · CIAM · MFA
To control who gets in, employees and customers.
IGA · IDM · SOD Intelligence
To prove who has what, and why, and sustain audits. This is where NLC | SOD Intelligence operates.
PAM · ITDR
To protect critical accounts and watch access live.
From a quarterly snapshot to continuous alerts.
Assessment
IAM process, ITGC/ITAC, SoD matrix and conflicts.
Remediation
Conflicts treated and roles optimized.
Structuring
Approved role map and SAT matrix.
Automation
Provisioning within SoD rules.
Live monitoring
AI agents watching access in real time.
NLC|SOD Intelligence
Graph engine, specialized AI agents and 100% data coverage, the assessment becomes continuous monitoring.
Who accesses what, on what grounds, since when?
If the answer isn't immediate and verifiable, the risk already exists. That's where the conversation starts.