ECB identity security mandate pushes banks toward zero trust

At a glance

What this is: The ECB is requiring supervised banks to submit an AI-risk action plan that elevates identity controls, continuous verification, and runtime monitoring to supervisory priority.

Why it matters: Identity and IAM teams in financial services need to treat continuous verification, least privilege, and service-account governance as board-level resilience requirements, not optional hardening.

👉 Read Unosecur's analysis of the ECB's identity security mandate for banks

Context

The ECB letter turns AI-enabled exploitation speed into a governance problem for banks, not just a tooling problem. For identity security, the practical issue is that perimeter-centric models cannot absorb a shorter path from vulnerability discovery to exploitation.

The article frames this as a DORA-backed supervisory expectation for significant institutions in euro-area banking, with action plans due by 31 October 2026. That makes identity governance, runtime monitoring, and third-party access control part of resilience planning rather than a separate IAM programme.

The strongest signal is the explicit inclusion of users, devices, applications, APIs, and service accounts in the ECB's zero-trust language. That is a clear acknowledgement that human and non-human identities now share the same operational risk surface.

Key questions

Q: What breaks when organisations rely on periodic access reviews for AI systems?

A: Periodic access reviews break when the identity scope changes between review cycles. AI-enabled workflows can create, use, and retire access faster than reviewers can validate it, so certification no longer reflects reality. That leaves stale permissions active and makes breach exposure harder to detect before it is used.

Q: Why do service accounts and APIs increase risk in the ECB's zero-trust model?

A: Because the model assumes attackers can move through identities after initial access, not just through networks. Service accounts and APIs often hold the permissions that make that movement possible, especially when least privilege, logging, and continuous verification are uneven across environments.

Q: What are the signs that identity controls are not keeping pace with AI-driven threats?

A: Common warning signs include stale credentials, excessive privileges, delayed access reviews, weak visibility into who has access, and security teams relying on manual approvals for changes that should be automated. If attackers can log in with weak or stolen credentials and move laterally before controls react, identity is functioning as a bottleneck instead of a security boundary.

Q: How should banks align DORA readiness with identity governance under the ECB letter?

A: Banks should treat DORA implementation as an operational resilience programme that includes identity scope, runtime logging, least privilege, and supplier access. The regulatory expectation is not a document set alone. It is evidence that identity can be governed continuously across internal and external boundaries.

Technical breakdown

Why AI compresses the vulnerability-to-exploit window

The ECB's core concern is speed. AI-assisted discovery can shorten the interval between a vulnerability appearing and a working exploit being used, which reduces the value of controls that only act on periodic cycles. In identity terms, that means delayed review, delayed patching, and delayed detection all lose effectiveness at the same time. The operational question is no longer whether a control exists, but whether it can react inside the exposure window that AI creates. Practical implication: move critical identity and exposure controls from review-based cadences to runtime and near-real-time enforcement.

Practical implication: Move critical identity and exposure controls from review-based cadences to runtime and near-real-time enforcement.

Zero trust for users, APIs, and service accounts

The letter's zero-trust language matters because it extends beyond human logins. Continuous verification of users, devices, applications, APIs, and service accounts means identity is treated as the control plane after initial network assumptions fail. For banks, that changes the scope of governance from employee access alone to the full chain of human and non-human actors that can call systems, move laterally, or trigger transactions. Least privilege and complete inventory are not abstract principles here; they are the mechanism that prevents an exposed credential from becoming systemic access. Practical implication: align entitlement design and logging across all identity types, not just employees.

Practical implication: Align entitlement design and logging across all identity types, not just employees.

Why runtime monitoring now sits inside resilience planning

The ECB is effectively treating identity telemetry as operational resilience evidence. Access logs, network traffic, and indicators of compromise become more valuable when exploitation can happen faster than periodic governance can respond. That shifts identity monitoring from audit support to active defence, especially where cloud, third-party, and service-account activity are involved. Runtime baselines also matter because anomalous access patterns in machine identities often look normal in static inventories. Practical implication: make identity behaviour monitoring part of incident detection and supervisory reporting, not a retrospective control check.

Practical implication: Make identity behaviour monitoring part of incident detection and supervisory reporting, not a retrospective control check.

Threat narrative

Attacker objective: The attacker aims to turn a short-lived vulnerability into rapid internal access and broader operational disruption before defenders can react.

1. Entry occurs through AI-accelerated discovery of exposed internet-facing assets, third-party software, or open-source components that were already in scope.
2. Credential or access abuse then follows through service accounts, APIs, or other identities whose permissions were not tightly bounded at runtime.
3. Impact comes from faster exploitation and broader reach before defenders can patch, verify, or contain the compromised path.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is now a supervisory resilience control, not an IAM preference. The ECB letter makes clear that banks are being judged on whether identity controls can absorb faster exploitation cycles, not just whether they exist on paper. That shifts the centre of gravity from access administration to continuous operational control. For financial institutions, the practitioner implication is that identity programmes now need to be defended as resilience infrastructure.

Continuous verification becomes the only defensible response when exploitation windows collapse. Periodic review logic assumes there is time to observe, certify, and remediate access before harm occurs. AI-driven vulnerability discovery compresses that time so aggressively that review-based governance no longer matches the threat tempo. The implication is not simply more monitoring, but a reordering of control priority around runtime decisions.

Service accounts and APIs are no longer secondary governance concerns. The ECB names them inside its zero-trust expectations, which means the supervisory view now includes non-human actors as part of the primary attack surface. That is an important shift for banks that still separate workforce IAM from machine identity governance. Practitioners should treat entitlement scope, logging, and verification as one policy domain across both human and non-human identities.

Runtime visibility is the new evidence standard for identity risk. The letter's emphasis on monitoring, logging, and third-party assurance indicates that static inventories are insufficient on their own. What matters is whether identity behaviour can be observed as it happens, especially across cloud and supplier boundaries. The broader lesson is that governance without telemetry will not satisfy either security teams or supervisors.

Continuous visibility and least privilege together define the new control baseline. The ECB is not asking banks to choose between governance and defence. It is asking them to operate both continuously, with inventories, approvals, logging, and access scope all tied to the same risk picture. For identity leaders, the practical conclusion is that fragmented IAM and security operations are no longer good enough.

What this signals

Identity blast radius is now a supervisory concept. The ECB's framing makes clear that the useful question is not whether an attacker gets in, but how far identity permissions allow them to move once they do. Banks should therefore review whether their current governance model limits reach across human and non-human identities, or merely records it after the fact.

DORA and zero trust are converging at the identity layer. For financial institutions, that convergence means access scope, logging, and continuous verification are no longer separate initiatives. They are now part of the same resilience story, and programmes that keep them siloed will struggle to prove control effectiveness.

Runtime identity telemetry is becoming an assurance input. Supervisory expectations are moving toward proof that access can be observed, interpreted, and constrained while systems are live. For practitioners, that means the next step is less about bigger inventories and more about whether those inventories are operational enough to change decisions.

For practitioners

• Map every identity and asset continuously Build and maintain an always-current inventory of human identities, non-human identities, cloud assets, VPN paths, and third-party connections so exposed attack surfaces are visible before they are exploited.
• Shift identity controls to runtime enforcement Treat access review as supporting evidence, not the primary control, and enforce least privilege and verification at the moment access is used.
• Expand monitoring to identity behaviour Correlate access logs, anomalous service-account activity, and external exposure signals so compromise indicators are detected while exploitation windows are still open.
• Bring third-party access into the same control plane Track supplier identities, delegated access, and cross-system permissions together so third-party exposure is governed with the same rigor as internal access.

Key takeaways

• The ECB letter treats identity controls as part of bank resilience because AI is compressing the gap between vulnerability discovery and exploitation.
• Supervisors are now asking banks to govern users, APIs, and service accounts together, which pushes machine identity into the same control plane as workforce IAM.
• Banks that can prove continuous inventory, runtime monitoring, and least privilege across internal and third-party boundaries will be better placed to meet the October deadline.

Key terms

• Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Service Account Governance: The set of policies and operational controls used to manage non-human accounts across their full lifecycle. It covers provisioning, access scope, rotation, revocation, and review, with the goal of preventing long-lived credentials from becoming persistent paths into critical systems.

What's in the full article

Unosecur's full article covers the operational detail this post intentionally leaves for the source:

• The ECB letter's four short-term focus areas and how each maps to bank security operations
• Unosecur's explanation of how its identity fabric and MCP Auth Gateway are positioned against the ECB requirements
• The article's view on continuous governance, just-in-time access, and runtime monitoring across cloud and third-party boundaries
• The FAQ section's specifics on DORA, deadlines, and non-human identities in bank environments

👉 Unosecur's full article covers the ECB letter, DORA context, and the identity control changes banks need to make before October 2026.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.