TL;DR: AI-driven shadow IT, deepfakes, and exploding machine identities are widening attack surfaces and weakening trust assumptions, according to Delinea. The bigger issue is that identity assurance can no longer rely on static checkpoints when people, machines, and tools all act at digital speed.
At a glance
What this is: This is Delinea’s case for continuous identity verification as the default control in AI-era environments, driven by shadow AI, deepfakes, and machine identity sprawl.
Why it matters: It matters because IAM, PAM, and NHI programmes can no longer rely on one-time trust decisions when identities, tools, and access paths all change in motion.
Context
Identity trust is the decision to believe that a person, machine, or agent is who it claims to be and should keep the access it was given. Delinea’s argument is that this trust model breaks down when AI tools, deepfakes, shadow IT, and machine identities can all change the access picture between one check and the next.
The governance gap is not simply more identity volume. It is the loss of a stable moment at which identity, intent, and privilege can be assumed to stay fixed long enough for a static control to be meaningful.
For IAM and PAM teams, the practical question is no longer whether to verify identity, but where in the session, workflow, or delegation chain that verification must keep happening.
Key questions
Q: What breaks when identity is treated as a login layer only?
A: When identity is treated as a login layer only, teams miss the fact that many high-risk decisions happen after authentication, inside delegated workflows and tool chains. That leaves privilege use, session behaviour, and agent action paths outside the governance model. The result is weak accountability and poor visibility into how access is actually consumed.
Q: Why do deepfakes create such a problem for video-based approval processes?
A: Because they exploit a control assumption that was never designed for synthetic media. A human reviewer may recognise a familiar face, but that does not prove the participant is physically present, on a real camera, or the legitimate actor behind the screen. Once the approval path trusts the image itself, the attacker only needs to imitate the image convincingly.
Q: What are the biggest risks of unmanaged machine identities?
A: Unmanaged machine identities can retain forgotten permissions, overprivileged access, and exposed credentials that attackers can reuse. Because they often operate without direct human supervision, they can become silent pathways into data, APIs, and privileged workflows. The risk grows when ownership, expiry, and session monitoring are missing.
Q: How should security teams govern identity fabrics across human, machine, and AI access?
A: Treat identity fabric design as a governance model, not a tool replacement. Start by aligning provisioning, privilege, review, and offboarding across human, machine, and AI identities so that policy follows the entitlement, not the platform. The goal is consistent control decisions across all actor types, especially where delegated access crosses system boundaries.
Technical breakdown
Why static identity checkpoints fail in AI-era environments
Traditional identity controls assume that authentication is the main trust event and that the resulting session stays materially stable. AI-driven tool use, shadow IT, and machine identities break that assumption because access can be created, combined, and consumed faster than a periodic review can observe it. In practice, the control failure is not only weak authentication. It is the gap between initial approval and the many downstream actions that happen after the checkpoint has passed. When identity, tool usage, and privilege can all shift during execution, trust has to move from a one-time gate to a continuously evaluated state.
Practical implication: Treat identity verification as an ongoing control, not a login event, and extend monitoring into active sessions and delegated workflows.
How deepfakes and behavioural signals change identity assurance
Deepfakes undermine the assumption that visual, audio, or conversational cues are reliable proof of who is present. That shifts identity assurance toward layered signals such as risk-based authorisation, behavioural patterns, device context, and transaction history. The security problem is not only impersonation. It is that a convincing imitation can reach the point where a human approver or service desk treats it as legitimate long before any downstream anomaly appears. Continuous identity verification therefore combines authentication with decisioning that can adapt as the interaction unfolds.
Practical implication: Use behavioural and contextual signals to re-evaluate trust during sensitive requests, not just at initial sign-in or help-desk verification.
Why machine identities need the same verification discipline as people
Machine identities are service accounts, bots, API keys, tokens, and similar non-human identities that act on behalf of systems and workflows. Delinea’s point is that these identities now outnumber human users and can become weak spots when they are forgotten, overprivileged, or left with credentials that never expire. The core governance issue is ownership and visibility: if a machine identity can authenticate, call tools, or move data, it needs inventory, least privilege, session monitoring, and expiry discipline just like a human account does. Otherwise, the identity estate grows faster than the control model around it.
Practical implication: Apply the same lifecycle governance to machine identities that you already expect for human privileged access.
Threat narrative
Attacker objective: The objective is to use trusted identity paths, whether human or machine, to gain access that looks legitimate long enough to expose data or trigger privileged actions.
- Entry occurs when shadow AI, exposed credentials, or a convincing deepfake opens a trusted path into the environment or into an approval workflow.
- Credential or trust abuse follows when the attacker or unsafe workflow uses that trust to reach API keys, tokens, or other privileged access paths.
- Impact comes when sensitive data is exposed, access is expanded, or mission-critical information is acted on under a false identity.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Constant identity verification is becoming the baseline because static trust no longer matches how access is actually used. Authentication once at the front door is not enough when AI tools, bots, and human workflows keep changing the effective risk profile after login. The governing principle is shifting from prove once to prove continuously, which means trust must be treated as a live state rather than a completed step.
Identity trust debt is the hidden problem this article surfaces. Organisations accumulate trust debt when credentials, approvals, and delegated access outlive the context that justified them. The more AI accelerates work, the more that debt compounds across people, machines, and processes. Practitioners should read this as a governance signal: the issue is not just more identities, but more stale trust attached to them.
Machine identities are no longer a back-office hygiene issue. When service accounts, tokens, and bots outnumber human users, they become part of the operational trust fabric. That changes the security programme from account management to identity assurance across the full runtime estate. The practical conclusion is that NHI controls and human trust controls now have to converge around continuous verification.
Deepfakes create an assumption failure in human identity governance. Controls designed for recognisable people and stable approval chains were built for conditions where the actor could be verified by familiar cues. That assumption fails when a synthetic voice or video can stand in for a trusted person at decision time. The implication is that approval processes must stop relying on human recognisability as a security control.
Identity trust now spans human IAM, NHI governance, and autonomous behaviour in one operating model. The article is really describing a single challenge: how to keep trust measurable when a person, a machine, or an AI-driven workflow can all initiate access at digital speed. Practitioners should stop treating these as separate governance problems and start aligning verification, authorisation, and monitoring across all three.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Why NHI Security Matters Now
What this signals
Identity trust debt: organisations are accumulating stale assurance wherever access decisions outlive the context that justified them. The practical challenge is not only to verify more often, but to make sure the trust state itself is continuously reassessed across sessions, workflows, and delegated actions.
Continuous identity verification changes how security programmes think about privilege. If access can be created and consumed faster than a review cycle, then verification has to move closer to issuance, authorisation, and ongoing use. That is a governance shift, not just a tooling upgrade.
For practitioners
- Continuously inventory AI tools and access pathways Map where AI tools are being used, what data they touch, and which identities they rely on so hidden connections do not become unmanaged attack paths.
Key takeaways
- AI-era identity risk is less about a single weak login and more about trust decisions that stay in place after the context has changed.
- Machine identities and deepfakes both widen the gap between recognition and actual assurance, which makes static checkpoints less dependable.
- Continuous verification, least privilege, and lifecycle governance are now inseparable parts of one identity security model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on continuous verification and weak trust assumptions in NHI and AI-era access. |
| NHI-05 — Overprivileged NHI | The article highlights overprivileged bots, forgotten service accounts, and stale access paths. | |
| NHI-07 — Long-Lived Secrets | Credentials, API keys, and tokens are called out as continuously exposed risk objects. | |
| Recommendation — Apply continuous authentication checks to high-risk NHI access paths and re-evaluate trust during use. Review NHI privileges against actual task scope and remove access that no longer matches use. Rotate long-lived secrets and expire credentials automatically wherever machine access persists. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Continuous identity verification maps to managing permissions and authorisations as conditions change. |
| Recommendation — Continuously validate entitlements for people and machines against current business need. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes how exposed credentials and trusted access paths can be abused for further reach. |
| Recommendation — Track exposed identities to credential access and lateral movement techniques in detection and response. | ||
Key terms
- Continuous identity validation: A governance model that checks identity trust throughout execution rather than only at login or periodic review. For AI and machine identities, this means verifying access, scope, and behaviour in real time so actions can be constrained while they are happening.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Identity Trust Debt: The accumulation of access relationships that were once justified but are now stale, excessive, or poorly owned. In SaaS and NHI environments, trust debt grows when discovery outpaces revocation and the organisation begins treating unresolved access as normal.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org