Joiner-Mover-Leaver — The Metric That Actually Predicts Breach Risk

The single strongest predictor of insider-driven access risk is not policy sophistication — it's JML latency: the time between an HR event and the corresponding access change.

What to instrument

1. HR event timestamp (source of truth).

2. IdP account creation / disablement timestamp.

3. Downstream app access change timestamp (per target).

4. Delta at each hop.

Targets that actually move the needle

• Joiner productive access within 4 business hours.
• Leaver revocation across critical apps within 5 minutes.
• Mover reconciliation completed within 24 hours.

Most enterprises can't answer these questions today. The ones that can — measurably reduce their audit findings and dwell time.