TL;DR: The largest identity security gap is authorization rather than authentication, with excessive privileges, stale entitlements and forgotten service accounts driving breach impact even after MFA, SSO and passwordless adoption, according to Opti’s analysis drawing on SACR research. The control problem is no longer the front door; it is the unlocked rooms behind it.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Opti's blog post: Authorization sprawl, stale entitlements and forgotten service accounts are now the dominant identity governance gap, while MFA-heavy programmes leave downstream privilege risk unresolved.
Why it matters: IAM, IGA, PAM and NHI teams need to treat entitlement scope and lifecycle control as the real enforcement layer, because strong authentication does not stop misuse of already granted access.
Context
Authentication strength is no longer the main failure point in many identity programmes. The governance gap is authorization, because organisations can verify a user or workload and still leave them with far more access than they should have once inside.
That gap widens in environments with SaaS sprawl, cloud role fragmentation, service accounts and emerging AI agents. When entitlements are opaque, access reviews become administrative exercises rather than control decisions, and remediation turns into manual coordination instead of governed change.
Key questions
Q: How should IAM teams reduce authorization sprawl across apps and APIs?
A: They should centralise roles, permissions, and conditional access rules in one policy model, then distribute those policies consistently across applications and APIs. The goal is to stop each codebase from becoming its own access system. That reduces drift, improves auditability, and makes access changes easier to govern across the full application portfolio.
Q: Why do access reviews fail when entitlement data is incomplete?
A: Access reviews fail because certification only validates what is in the system of record. If ownership, application scope, or account mappings are stale, reviewers approve or revoke against a distorted picture. The result is process activity without real governance. Good certification programmes start with accurate entitlement data and clear accountability, not with more review cycles.
Q: Why do static service accounts create so much breach risk in cloud environments?
A: Because they persist until someone revokes them, and that persistence gives attackers a reusable foothold. If the account is over-scoped, embedded in code, or forgotten after a project ends, the credential can survive long enough to support lateral movement and data access. The risk is endurance, not just exposure.
Q: What is the difference between authentication and authorization in IAM?
A: Authentication proves an identity is who or what it claims to be. Authorization determines what that identity can do after it is accepted. In production environments, authorization is usually the harder and more important control because it governs scope, duration, and blast radius.
Technical breakdown
Why entitlement sprawl breaks traditional IGA
Identity governance tools were designed to move access through workflows, not to understand the meaning of the access itself. An entitlement is more than a string in a directory or a checkbox in a review sheet. In practice, the same role or policy can represent very different business power across AWS, Azure, Salesforce and custom systems. Without semantic normalization, IGA can certify permissions that look routine but actually expose administrative, financial or data-access functions. That is why review volume can rise while real governance quality falls. The problem is not just scale; it is the lack of context that turns authorization into an unreadable inventory. See the IAM and IGA Basics.
Practical implication: Map entitlements to actual business capability before relying on certification or role engineering.
How stale service accounts create persistent blast radius
Service accounts and tokens become dangerous when they outlive their intended purpose or keep permissions that no longer match current use. Unlike human access, these identities often sit outside normal review habits, so dormant credentials and old permissions can remain active for long periods. That creates a durable blast radius: once a service account is compromised, its standing privileges can be reused across systems and workflows. The risk is amplified when teams treat machine identities as implementation details rather than governed identities with ownership, scope and offboarding requirements.
Practical implication: Treat service accounts as governed identities with explicit ownership and revocation paths.
Why access reviews fail without entitlement intelligence
Access reviews fail when reviewers are asked to approve technical permissions without knowing what those permissions actually enable. A spreadsheet full of roles, groups and tokens does not tell a manager whether access is excessive, redundant or risky in context. That is why review outcomes often skew toward approval, even when the environment clearly contains over-privileged accounts. Entitlement intelligence changes the review input by adding usage, peer comparison and policy meaning. The review then becomes a decision process instead of a paperwork ritual.
Practical implication: Enrich review workflows with usage and policy context so approvers can make meaningful decisions.
Threat narrative
Attacker objective: The attacker aims to turn legitimate access into broad operational reach by exploiting whatever permissions the identity already holds.
- Entry begins when attackers obtain legitimate credentials, tokens or service account access rather than forcing a login failure.
- Escalation follows when excessive privileges and stale entitlements let the intruder inherit broad permissions across connected systems.
- Impact occurs when the compromised identity is used to move laterally, expand access and prolong dwell time before remediation catches up.
Breaches seen in the wild
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Authorization is now the primary identity security problem. Authentication has absorbed most of the industry’s attention, but that control only answers who can enter. The harder question is what they can do once inside, and modern breach patterns keep answering it through privilege sprawl, stale entitlements and over-permissioned accounts. This shifts the centre of gravity from login assurance to access meaning, which is why governance programmes that stop at MFA have not closed the real exposure.
Entitlement intelligence is the missing semantic layer in IGA. Traditional governance systems can move approvals around, but they do not always understand the business effect of what they are approving. Without that meaning layer, certifications become mechanical and role engineering becomes guesswork. The result is control coverage without control clarity, and practitioners should re-evaluate whether their current stack can distinguish benign access from risky privilege in context.
Authorization sprawl turns every identity review into a remediation backlog. Even when teams identify excess privilege, the operational cost of fixing it across cloud, SaaS and legacy systems often delays action long after the risk is known. That delay is not a process inconvenience; it is the period in which attackers benefit from the mismatch between granted access and intended access. The governance model must account for time-to-remediation, not just discovery.
Service account governance is the weak point in many identity programmes. Organisations often manage human access more visibly than machine access, even though workloads and automation now hold a large share of reachable privilege. The overlooked failure mode is persistent machine identity authority without equally persistent ownership, review and offboarding discipline. Teams should treat NHIs as a governed population, not as infrastructure residue.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Authorization drift: identity teams should expect the governance conversation to move from login assurance to entitlement meaning, because attackers increasingly exploit what access can do rather than how it was obtained.
The practical programme shift is toward continuous review of access scope, ownership and usage, especially where SaaS sprawl and service accounts create permissions that no quarterly certification can fully capture.
Only 5.7% of organisations have full visibility into their service accounts, which means most teams are still trying to govern machine identity risk with partial inventory and incomplete context.
For practitioners
- Audit entitlement meaning, not just entitlement count Build a normalised view that maps roles, groups and policies to actual business capability across SaaS, cloud and legacy systems.
- Rework access reviews around decision context Give reviewers usage patterns, peer baselines and policy explanations so certifications evaluate real privilege rather than technical labels.
- Put service accounts under explicit lifecycle control Assign owners, document purpose, track revocation criteria and review machine identities on the same cadence used for other governed accounts.
- Shorten the time between detection and remediation Prioritise workflows that can change access quickly across connected systems instead of routing every entitlement fix through manual tickets.
- Separate authentication assurance from authorization risk Measure whether strong login controls are being offset by excessive permissions, dormant accounts and unmanaged tokens elsewhere in the stack.
Key takeaways
- The central identity problem is no longer entry control alone, but the scope of access granted after authentication succeeds.
- Service accounts, stale entitlements and excessive privilege create the main blast radius in modern IAM and NHI environments.
- Governance improves when entitlement meaning, ownership and remediation speed become first-class controls rather than side effects of certification.
Related NHI Mgmt Group resources: IAM and IGA Basics · Ultimate Guide to NHIs: What are Non-Human Identities · Dropbox Sign breach 2024
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Excessive privileges are the central failure mode in Opti's authorization-sprawl analysis. |
| NHI-07 — Long-Lived Secrets | The post highlights forgotten service account tokens and persistent access that outlive their purpose. | |
| NHI-01 — Improper Offboarding | Stale service accounts and forgotten tokens point to weak lifecycle closure for non-human identities. | |
| Recommendation — Review NHI entitlements for privilege excess and remove access that exceeds current business need. Track secret age and rotate or revoke long-lived machine credentials before they become standing risk. Offboard machine identities with the same discipline used for user accounts and remove unused access paths promptly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Authorization sprawl maps directly to permissions and entitlement governance in CSF 2.0. |
| Recommendation — Apply entitlement governance controls to verify that every permission remains justified and current. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article repeatedly shows that breach impact grows when identities receive more access than needed. |
| Recommendation — Enforce least privilege so identity scope stays aligned to the minimum needed for each task. | ||
| CIS Controls v8 | CIS-5 — Account Management | Service account sprawl and dormant access are account-management failures across human and machine identities. |
| Recommendation — Maintain a current account inventory and disable accounts that no longer have a valid purpose. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Credential-based breaches in the source pattern rely on legitimate access and lateral movement through over-privileged identities. |
| Recommendation — Map credential-driven intrusion paths to TA0006 and TA0008 to prioritise detections around privilege reuse and movement. | ||
Key terms
- Authorization sprawl: Authorization sprawl is the gradual expansion of access rules, roles, and exceptions across an application estate. It usually starts with one simple product model and becomes difficult to govern once many services and business functions depend on the same decision layer.
- Entitlement intelligence: The structured understanding of who has which permissions, why those permissions exist and whether they are still justified. Strong entitlement intelligence depends on accurate role definitions, ownership metadata and permission mapping across the application estate.
- Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org