TL;DR: Clarity Security says identity governance has been treated as compliance evidence and periodic review, but that model leaves risk to accumulate between cycles because it does not continuously assess access or close exposure when it appears. The shift matters because governance alone cannot prove access is appropriate, limit blast radius, or handle non-human and AI identities at the pace they now operate.
At a glance
What this is: This is a Clarity Security announcement about Clarity Aperture, a unified identity security platform that ties continuous risk scoring and remediation to governance across human, non-human, and AI identities.
Why it matters: It matters because IAM and IGA teams cannot rely on periodic reviews alone when exposure changes continuously across service accounts, API keys, bots, and human access paths.
By the numbers:
- AI-related breaches affected organizations that lacked proper AI access controls in 97% of cases, according to IBM’s 2025 Cost of a Data Breach report cited by Clarity Security.
👉 Read Clarity Security's analysis of continuous identity risk and adaptive trust
Context
Identity governance answers who has access, but it does not tell security teams whether that access is still appropriate, how much exposure it creates, or how to close it when risk changes. That leaves a structural gap between audit evidence and actual risk reduction, especially where access paths span cloud, SaaS, legacy systems, and machine identities.
Clarity Security frames that gap as the place where breaches live. In this model, continuous risk assessment becomes the missing operating layer for identity security, while governance remains a compliance motion rather than the primary control for reducing exposure.
For non-human identity programmes, the problem is sharper because service accounts, API keys, OAuth apps, bots, and AI agents move faster than review cycles and often outnumber human accounts.
Key questions
Q: What breaks when access reviews are the primary identity control?
A: The control breaks because access can change, be abused, and disappear between review cycles. Review-based governance produces documentation, but not continuous enforcement. In practice, that means investigators can find clean records even when the environment had excessive access at the exact moment the incident occurred.
Q: When should organisations prioritise continuous risk scoring over periodic certification?
A: When identity relationships change faster than the review cycle can capture them, continuous scoring should come first. That is especially true for cloud, SaaS, and NHI-heavy environments where permissions are nested and exposure can spread quickly. Certification then becomes a reporting layer, not the primary risk gate.
Q: How do security teams know whether identity governance is reducing risk?
A: Look for shorter time from access change to visibility, fewer unmanaged entitlements, and faster completion of review and remediation cycles. If access risk remains unchanged after deployment, the programme may be reporting activity without changing control outcomes.
Q: What is the difference between governance evidence and identity risk reduction?
A: Governance evidence proves that access was reviewed, approved, or documented. Identity risk reduction proves that exposure was identified and actually closed. The two can overlap, but they are not the same control outcome, and treating them as equivalent leaves a blind spot between audit readiness and real security.
How it works in practice
Why periodic access reviews miss live identity risk
Periodic access reviews are designed to confirm whether access was approved, not whether it is still safe. They work on a calendar cadence, which means risk can accumulate between review cycles and remain invisible until the next certification. In environments with cloud, SaaS, mainframe, and federated access, that gap grows because permissions are nested, inherited, and frequently connected to other systems. The practical weakness is not visibility alone. It is that review evidence is detached from remediation, so teams can document exposure without actually reducing it.
Practical implication: Treat access review as evidence generation, not as the point where identity risk is controlled.
How dynamic risk scoring changes identity governance
Dynamic risk scoring evaluates identity and access relationships using both inherent and contextual signals, then ranks the riskiest paths first. That changes the governance model from broad certification to targeted action, where the highest-exposure accounts are surfaced before lower-value access. The architecture also matters because read and write capability across connected systems turns a finding into an executable change, instead of a ticket that leaves the platform and ages in another queue. This is the distinction between seeing risk and closing it.
Practical implication: Prioritise identity findings by exposure path, not by review schedule or asset owner convenience.
Why NHI and AI identities require separate governance depth
Non-human identities behave differently from human users because they are numerous, machine-speed, and often granted access through delegated workflows that humans do not revisit often enough. Service accounts, tokens, bots, and AI agents can chain permissions across systems, which makes ownership and accountability harder to maintain. When these identities are left in the same governance process as human access, the control plane becomes too slow for the attack surface. The article’s core point is that machine identities need continuous governance, not just periodic attestation.
Practical implication: Build a distinct inventory, ownership model, and remediation path for NHIs and AI identities.
NHI Mgmt Group analysis
Access review is not a risk control: It was designed to prove that access was approved, not to determine whether access is safe today. That assumption fails in environments where identity posture changes continuously across cloud, SaaS, and machine identities. The implication is that identity programmes must stop treating certification as the point of control and start treating it as one evidence layer among many.
Continuous risk, not periodic evidence, is the governing model now: The article is right to separate governance from exposure reduction. Governance documents state, while risk engines decide what needs to be closed first. That shift matters because the attack surface now changes faster than audit cadence, so practitioners need a control model that is live by design rather than retrospective by necessity.
Non-human identity is now the least governable part of the identity estate: Service accounts, tokens, bots, and AI agents can carry access chains that are invisible to human review processes. By treating them as first-class identities on the same graph as people, the post reflects the reality that NHI governance is no longer a niche control problem. Practitioners should expect machine identities to become the primary test of governance maturity.
Adaptive Trust is a useful name for a broader operating shift: The important change is not a new dashboard but the move from passive oversight to continuous closure of identity exposure. That re-frames identity security as a living control system, where risk, ownership, remediation, and evidence are linked in one motion. Security teams should judge their current programme by whether it can close exposure, not merely describe it.
Unified governance across human, NHI, and AI identities is where the category is heading: The article points to convergence between IGA, posture management, and remediation as the practical response to identity sprawl. That is not a product preference, it is a structural response to fragmented control planes. Practitioners should prepare for identity security programmes that are judged on closed risk, not review completion.
What this signals
Continuous identity control is becoming the baseline: Programmes built around quarterly or annual review cycles will continue to miss the window where exposure is created and abused. The operational shift is from proving access state to closing risky access while it still exists.
Machine identities expose the governance gap most clearly: Service accounts, API keys, bots, and AI agents often move through systems faster than manual attestation can follow. That makes ownership, blast-path visibility, and remediation linkage the controls that determine whether identity governance is real or ceremonial.
For practitioners
- Map review cadence to exposure decay Identify where access reviews are still being used as the primary risk control and mark those paths for continuous evaluation instead. Focus on identities whose privileges can change faster than the review cycle can certify them.
- Create a live remediation path for high-risk identities Require every high-risk identity finding to have an executable closure path in the same platform or workflow that detected it, so remediation does not depend on ticket handoff.
- Separate NHI governance from human attestation Build a distinct ownership, inventory, and escalation model for service accounts, API keys, bots, OAuth apps, and AI agents rather than folding them into human access reviews.
- Prioritise blast-path analysis over raw access counts Trace how identities inherit, chain, and expose privileges across connected systems before deciding what to remediate first.
- Use continuous risk signals for board reporting Report closed exposure and risk reduction over time instead of only completed review percentages, so governance outcomes reflect actual security posture.
Key takeaways
- Identity governance that stops at approval and certification leaves a live risk window open between review cycles.
- The article’s core evidence is that AI-related breach cases frequently involve weak access controls, which underscores how quickly identity exposure can outpace governance.
- Practitioners should measure whether findings are closed in the same workflow that surfaces them, not whether reviews are merely completed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article focuses on access that exceeds what identities should carry over time. |
| NHI-03 — Vulnerable Third-Party NHI | Federated access and connected systems expand exposure through external identity relationships. | |
| NHI-07 — Long-Lived Secrets | AI agents and service accounts often remain exposed because credentials outlive the review cycle. | |
| Recommendation — Review and reduce excess machine access using NHI-05 as the primary governance lens. Assess third-party and federated identities for inherited exposure and remove risky dependencies. Inventory long-lived secrets and shorten credential lifetimes where review cycles cannot keep up. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The post argues that access should be continuously constrained to actual need. |
| Recommendation — Apply least-privilege controls to reduce standing access and revalidate high-risk entitlements. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing entitlements as conditions change, not only documenting them. |
| Recommendation — Use PR.AA-05 to keep entitlements aligned to current risk, ownership, and business need. | ||
Key terms
- Continuous Adaptive Trust: Continuous adaptive trust is a runtime access model that adjusts permissions as an agent behaves. Access is time-bound, purpose-bound, and context-aware, then reduced or revoked when actions drift from expected intent. It is a stronger fit for agents than static entitlements alone.
- Continuous Risk Scoring: Continuous risk scoring assigns and updates an identity risk value as behaviour, entitlements, location, and privilege level change. It gives security teams a prioritisation mechanism for access decisions, but it only works when the score is tied to a clear governance action.
- Blast path analysis: A way of tracing how one identity or entitlement can lead to broader access across systems and datasets. It helps practitioners prioritise the identities most likely to expand compromise, especially where nested permissions and federated relationships hide the true exposure chain.
- Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.
What's in the full announcement
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- The dynamic risk scoring model used to rank identity exposure across human and non-human identities
- How the platform maps nested permissions, federated access, and blast paths into a remediation workflow
- The NHI & AI Security module’s coverage of service accounts, API keys, OAuth apps, bots, and AI agents
- The evaluation feedback and customer commentary that illustrate how practitioners are positioning unified identity security
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 4, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org