Axiad’s CRO hire signals a broader push into identity risk

At a glance

What this is: This is a press release about Axiad naming Jay Carpenter as chief revenue officer, with the substantive signal being that the company is framing identity risk as a cross-domain governance problem spanning people, machines, NHI, and AI agents.

Why it matters: It matters because IAM, IGA, PAM, and NHI programmes increasingly have to govern a mixed identity estate, not separate silos, and that changes how teams measure exposure, visibility, and lifecycle control.

Context

Axiad’s announcement is a staffing story on the surface, but the underlying topic is identity risk and how enterprises are trying to manage it across an expanding set of identity types. The article positions identity as the primary attack surface and ties that directly to users, devices, machines, non-human identities, and emerging AI agents.

For IAM practitioners, the significance is not the executive hire itself. It is the claim that traditional IAM tools and legacy PKI leave fragmented visibility when identity estates span human access, workload access, credential management, and automated identity verification. That places governance, lifecycle control, and risk quantification at the centre of the programme conversation.

Key questions

Q: How should IAM teams govern human, non-human, and AI identities together?

A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct. Human users, service identities, and AI systems do not fail in the same way, so the governance model has to preserve that difference while still producing one audit trail.

Q: Why do legacy IAM and PKI models fall short as identity estates expand?

A: They assume clearer ownership, slower lifecycle change, and more stable issuance patterns than modern identity estates provide. Once machine identities, third-party credentials, and automated access paths multiply, the control model fragments across tools and review cycles lose their ability to see risk in time.

Q: What signals show that identity visibility is not keeping up with risk?

A: The clearest signs are disconnected inventories, duplicate credential ownership, unclear revocation responsibility, and risk reports that do not change remediation priority. If teams can describe accounts but cannot explain which ones matter most to the business, visibility has not become governance.

Q: How should organisations govern non-human identities alongside human IAM?

A: Treat non-human identities as a separate control population with their own inventory, ownership, lifecycle, and reporting. Service accounts, API keys, tokens, certificates, and AI agent credentials should not be folded into generic IAM metrics. That separation makes privilege review, rotation, and offboarding measurable and prevents hidden machine access from accumulating outside normal access governance.

Technical breakdown

Unified identity visibility across human and non-human estates

A unified identity visibility and intelligence layer attempts to correlate identity risk across disparate credential types, account types, and systems. In practical terms, that means humans, devices, machines, service identities, and AI-oriented access paths are treated as one risk surface instead of separate operational queues. The architectural challenge is not collection alone. It is normalising identity data enough to identify exposure, quantify it consistently, and tie it back to a governable control model. Without that normalisation, inventory and risk reporting stay fragmented, which is exactly where identity sprawl hides.

Practical implication: inventory every identity class in one control view and define common risk fields before you try to automate remediation.

Why legacy IAM and PKI controls stop short

Legacy IAM and PKI were designed around narrower assumptions about identity ownership, issuance, and review cadence. They work less well when credentials proliferate across machines, third-party integrations, and automated identity verification flows, because the control plane no longer sees a single human lifecycle. That creates a governance gap between authentication, credential management, and entitlement oversight. The article’s core mechanism is that risk becomes distributed across multiple identity forms, while older control models still expect clearer boundaries between user accounts, keys, certificates, and device trust.

Practical implication: review where IAM, PKI, and credential management are split across teams or tools and collapse the highest-risk gaps first.

Identity risk quantification as a governance model

Quantified identity risk analysis is more than reporting. It is a way to prioritise where fragmented identity estates create the greatest exposure and where controls should be tightened first. In governance terms, that usually means linking identity visibility to business context, privilege scope, and control weakness rather than counting accounts in isolation. When done well, the model supports better decisions about authentication strength, credential lifecycle, and offboarding discipline across both human and non-human identities. When done badly, it becomes a dashboard without decision power.

Practical implication: use risk scoring to drive control prioritisation, not as a reporting layer that sits apart from remediation.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity risk has become a programme-level governance issue, not a tooling feature. Axiad’s framing shows that enterprises no longer manage separate problems for users, machines, and AI-adjacent identities. They manage one expanding identity attack surface that cuts across IAM, credential management, and lifecycle control. That means identity governance has to be measured as an enterprise control plane, not as a collection of disconnected admin tasks.

Legacy IAM and legacy PKI now leave a visibility gap that modern identity sprawl exploits. Those models were built for more stable identity populations and clearer issuance boundaries. Once machine identities, third-party credentials, and AI-related access paths enter the estate, the old split between authentication, inventory, and risk analysis stops holding. Practitioners should read that as a structural mismatch between control design and current identity reality.

Unified identity intelligence is the named concept that this market is converging on. The useful shift is not broader inventory for its own sake, but the ability to quantify where identity exposure concentrates and where governance fails to keep pace. That concept matters because security teams need a way to compare risk across humans, NHIs, and emerging autonomous access patterns. The practical conclusion is to treat identity intelligence as a prioritisation engine for governance, not as a reporting add-on.

AI agents and NHIs make access governance time-sensitive in a way human-centric models are not. Even when the article stays high level, its reference to emerging AI agents points to a governance problem where access may be created, used, and discarded faster than periodic review cycles can observe. That does not mean every AI-adjacent workflow is autonomous, but it does mean human review cadences are increasingly misaligned with the speed of non-human access. Practitioners should rework control timing around issuance and revocation, not review after the fact.

What this signals

Unified identity visibility is becoming the practical baseline for mixed estates. Security teams can no longer assume that user IAM, machine identity, and credential management will stay separable for governance purposes. The operational question is whether the programme can see enough of the estate to set priorities before access sprawl becomes unmanageable.

Identity risk scoring only matters when it changes control placement. If quantified risk does not alter which identities get monitored, tightened, or offboarded first, the model is just reporting. The programme value comes from connecting identity intelligence to real governance decisions across issuance, privilege, and revocation.

Machine and non-human identity governance is now part of core IAM design. A mixed identity estate forces teams to rethink ownership, lifecycle boundaries, and review cadence. Practitioners should prepare for a control model where identity type determines the governance path, not the other way around.

For practitioners

• Map the full identity estate Build a single inventory that includes human accounts, machines, service identities, certificates, and any AI-related access paths so governance starts from one view of exposure.
• Align credential management with identity risk Tie credential issuance, rotation, and revocation to risk scoring so privileged and high-value identities are handled before they accumulate blind spots.
• Close the visibility gap between IAM and PKI Document where authentication, certificate lifecycle, and identity verification sit in different tools or teams, then assign one accountable control owner for the overlap.
• Prioritise non-human identity governance Separate workload, machine, and service identities from human access reviews and govern them with controls that match their issuance and offboarding patterns.

Key takeaways

• Identity risk is no longer confined to human users, because the article frames machines, NHI, and emerging AI agents as part of the same attack surface.
• The governance problem is visibility fragmentation, where older IAM and PKI assumptions do not scale cleanly across mixed identity estates.
• Teams need one control view that connects inventory, credential lifecycle, and risk prioritisation so the programme can act on identity sprawl before it hardens into exposure.

Key terms

• Unified Identity Visibility: Unified identity visibility is the ability to map human and non-human access across data and AI environments in one view. It connects identities, entitlements, and activity so teams can see who or what is touching sensitive data. This visibility is the foundation for least privilege, monitoring, and governance.
• Identity risk quantification: Identity risk quantification is the process of turning access exposure into a defensible estimate of business impact. It goes beyond counting findings and asks what the issue could cost, how far it could spread, and which remediations should happen first.
• Non-Human Identity Governance: Non-human identity governance is the practice of managing, controlling, and auditing every machine identity across its full lifecycle. It covers service accounts, API keys, tokens, certificates, and AI agent credentials, ensuring each has a defined owner, scoped privilege, rotation schedule, and revocation path. Without governance, NHIs accumulate silently and become the primary attack surface in cloud and automated environments.
• Identity Attack Surface: Identity attack surface is the total set of accounts, tokens, login endpoints, trust paths, and supporting systems that can be probed for access. For password spraying, the risk grows with every externally reachable authentication path and every dormant or weakly protected identity.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.