Delinea’s AI identity expansion signals a broader PAM shift

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Delinea's report: Delinea ties its first-half 2025 growth to a wider PAM and identity-security expansion, with AI discovery, entitlement management, and real-time authorization now part of the message.

Why it matters: IAM and PAM teams should read this as a sign that privileged access is being reframed around lifecycle governance for human, machine, and AI identities, not just administrative session control.

By the numbers:

• Delinea says annual recurring revenue has surpassed $400 million.
• Delinea says its platform is the only identity security provider to commit to 99.995% uptime.

Context

Delinea’s update is fundamentally about how privileged access management is widening into broader identity governance for humans, machines, and AI-driven workflows. The core issue is no longer only who can enter a privileged session, but how access is discovered, authorised, observed, and retired across hybrid environments.

That matters because AI-adjacent identity controls are now being framed as operational capabilities, not side features. Shadow AI discovery, entitlement management, and real-time authorization all point to the same governance question: whether identity programmes can keep pace with dynamic access paths that do not look like traditional administrator logins.

Key questions

Q: How should security teams govern AI access inside PAM programmes?

A: Security teams should treat AI access as part of the identity control plane, not a separate innovation stream. That means discovery, entitlement ownership, authorization, and review must cover AI-driven use cases alongside human and machine access. If AI paths are not inventoried and assigned accountability, they will bypass the controls PAM was designed to enforce.

Q: What breaks when shadow AI is not discovered early?

A: Teams lose sight of which agents exist, what they can reach, and which credentials they use. That creates blind spots in audit trails, incident response, and offboarding, especially when agents are created locally or disappear after a single task. Discovery failure becomes governance failure once the identity cannot be traced back to an owner.

Q: How do real-time authorization and traditional PAM differ?

A: Traditional PAM often governs access at the point of elevation or session start, while real-time authorization evaluates the current context each time access is used. The difference matters in hybrid environments because identities move across SaaS, cloud, and infrastructure faster than static approvals can reflect.

Q: Should organisations re-evaluate IAM and PAM for agentic AI deployments?

A: Yes, because agentic systems can inherit credentials and exercise privileged tools in ways that traditional IAM and PAM reviews do not fully capture. Organisations should reassess whether their current models account for ephemeral tasks, delegated authority, and machine-speed execution. The key test is whether access can be constrained to the exact task and revoked immediately afterward.

Technical breakdown

How AI identity controls extend privileged access management

Privileged access management historically focused on elevated human sessions, approval gates, and audit trails. Delinea’s framing shows a broader model in which the control plane now includes machine identities, AI usage, and entitlement decisions across cloud and traditional infrastructure. In practical terms, that means privileged access is being treated as a lifecycle problem, not a session-only problem. The architecture implied here combines discovery, policy, authorization, and auditing so that identity state can be evaluated continuously rather than only at login or at point of elevation.

Practical implication: separate session control from lifecycle governance so AI, machine, and human access can be governed in one policy model.

Why shadow AI detection matters to identity governance

Shadow AI is not just an application inventory issue. It is an identity visibility problem because unmanaged AI use can create untracked access paths, unmanaged entitlements, and unreviewed data exposure. When a platform claims to discover shadow AI, the governance value lies in surfacing where AI-related access exists before teams can certify it, revoke it, or assign accountable ownership. That places discovery ahead of enforcement in the control chain, which is the opposite of how many PAM programmes were originally designed.

Practical implication: inventory AI access paths before trying to govern them, or you will miss the identities that matter most.

What real-time authorization changes in hybrid environments

Real-time authorization shifts access decisions from static provisioning assumptions to context-aware evaluation at the moment of use. In a hybrid environment, that matters because the same identity may touch SaaS, cloud, and traditional infrastructure under different risk conditions. The technical value is not just faster approval. It is that access can be conditioned on current identity state, session context, and irregularity detection instead of relying on stale role assignments. This is where PAM begins to overlap with broader identity security and continuous access governance.

Practical implication: treat authorization as a runtime control, not a one-time admin task.

NHI Mgmt Group analysis

PAM is becoming an identity governance layer, not a session-control layer: Delinea’s update reflects a category shift that many teams are already experiencing. Privileged access is no longer limited to interactive administrator sessions, because modern enterprises now need to govern machine identities, SaaS privileges, and AI-driven access paths as part of the same control model. The practitioner takeaway is that PAM programmes now compete or coexist with broader identity governance expectations.

Shadow AI discovery is really a visibility control for unmanaged access paths: If AI use cannot be discovered, it cannot be authorised, reviewed, or retired. That makes discovery the first governance control, not an optional add-on, because unmanaged AI often creates privileged data access without ever entering a formal entitlement workflow. Teams should read this as a signal that identity inventory must now include AI use cases, not only accounts and tokens.

Real-time authorization is the right answer to stale entitlement assumptions: Static role assignment cannot keep up with hybrid access patterns where identities move between cloud, SaaS, and infrastructure contexts. Real-time authorization matters because it evaluates current conditions rather than trusting old provisioning decisions. The broader implication is that identity security is moving toward continuous decisioning, which changes how IGA, PAM, and operational security must be designed together.

Identity lifecycle governance now has to span humans, machines, and AI: The article’s framing assumes that secure enterprises must govern all three identity classes through one operational lens. That is where current programme boundaries start to blur, because access policies, audit trails, and entitlement ownership increasingly apply across every actor type. The practitioner conclusion is that identity architecture has to be built around lifecycle state, not identity label.

Identity blast radius becomes the more useful concept than privileged session count: The article’s strongest signal is that security value is shifting from how many privileged sessions are controlled to how broadly identity abuse could spread across systems. That matters because the practical risk is not just elevation, but the number of identities, entitlements, and environments touched when access goes wrong. Teams should measure control design by containment, not only by session oversight.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

AI identity governance will increasingly be judged by discovery quality, not just privilege reduction: If teams cannot see shadow AI, they cannot govern the access paths it creates. That shifts the programme question from how much privilege exists to whether identity inventory is complete enough to support enforcement, review, and offboarding.

Centralized authorization is moving from session protection into entitlement control: The practical boundary is widening across humans, machines, and AI use cases. Programmes that still separate PAM from IGA will struggle to explain who owns access, how it is approved, and when it should be revoked.

For practitioners

• Map AI access paths into identity inventory Add shadow AI, AI service identities, and delegated entitlements to the same inventory process used for human and machine accounts so governance does not stop at known administrators.
• Split session control from lifecycle control Use separate governance rules for elevation, entitlement ownership, and access review so temporary privileged sessions do not mask persistent identity sprawl.
• Establish real-time authorization checkpoints Evaluate access decisions at use time across SaaS, cloud, and traditional infrastructure when the same identity can move between contexts quickly.
• Define ownership for AI-related entitlements Assign accountable owners for AI tools, AI-connected data paths, and machine credentials so revocation and review do not depend on informal system knowledge.

Key takeaways

• The article signals a category expansion, with PAM now being described as a broader identity governance layer for humans, machines, and AI access.
• Its most important operational theme is visibility: shadow AI and entitlement sprawl are governance problems before they are enforcement problems.
• Teams should re-check ownership, discovery, and real-time authorization together, because separate controls will miss the access paths this model is trying to govern.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Real-Time Authorization: Real-time authorization is an access control approach that evaluates each request using current signals, context, and risk before allowing or revoking access. It is designed to replace static approval logic with decisions that reflect changing conditions, operational urgency, and security posture.
• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.