Federal zero trust mandates collide with identity risk sprawl

At a glance

What this is: This Delinea article argues that zero trust mandates are colliding with identity sprawl as agencies and enterprises accumulate more human, machine, service, developer, and AI identities than traditional governance models can control.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to prove continuous verification and least privilege across a much larger identity surface, not just across named users.

By the numbers:

• 86% of breaches involve compromised privileged credentials, according to the Delinea article citing Verizon DBIR 2023.
• 71% increase in attacks using valid credentials year-over-year, according to the Delinea article citing IBM X-Force Threat Intelligence Index 2024.
• Over 80% of hacking-related breaches involve stolen or weak passwords, according to the Delinea article citing ITGlue password rotation research.

Context

Identity risk sprawl describes the growth of human, machine, service, developer, and AI identities faster than the controls designed to govern them. In this article, Delinea argues that zero trust is colliding with that expansion because many programmes were built to satisfy audit expectations rather than to govern real-time identity abuse.

The central governance problem is not whether zero trust matters, but whether identity programmes can enforce continuous verification and least privilege across millions of identities, tools, and trust relationships. That pressure is especially acute in federal and regulated environments, where deadlines and architecture mandates force agencies to operationalise identity controls rather than simply document them.

The article treats identity as the control plane for zero trust: if identities are proliferating faster than visibility, policy, and privilege management, the architecture becomes fragile even when compliance looks complete. That is the starting point for the technical and governance analysis below.

Key questions

Q: What breaks when Zero Trust is implemented without identity governance?

A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data. If access approvals, ownership, and revocation are not governed, the organisation keeps validating entitlements that no longer match business intent. The result is technically strong enforcement built on weak identity records, which still leaves over-privileged accounts and hidden exceptions in place.

Q: Why do valid credentials still create so much risk in zero trust environments?

A: Because a credential can be valid and still be unsafe if it has more privilege than the current task requires. Zero trust reduces that risk only when access is re-evaluated continuously and privilege is minimized at runtime. If access stays static after authentication, the environment still trusts the wrong thing.

Q: How can security teams tell whether their identity programme is ready for zero trust?

A: Teams are closer to zero trust when they can verify identity continuously, limit standing access, and revoke privileges quickly across the full lifecycle. If inventory is incomplete or offboarding is slow, zero trust remains aspirational. The best indicator is whether identity decisions are based on current context rather than on one-time authentication.

Q: How should agencies respond when identity tools are fragmented across the stack?

A: They should treat fragmentation as an architecture defect, not a tooling preference. The goal is one identity control plane that correlates access, privilege, and activity across IAM, PAM, and adjacent systems, because isolated tools leave blind spots that attackers can exploit.

Technical breakdown

Why identity sprawl breaks zero trust enforcement

Zero trust depends on verifying each access decision in context, but identity sprawl weakens that model when the inventory itself becomes incomplete. If an organisation cannot reliably account for every human, service, workload, and AI identity, then least privilege becomes approximate rather than enforceable. The result is an environment where policy exists, but the control plane cannot confidently evaluate who or what is requesting access. In practice, the break occurs at discovery and entitlement correlation, not only at authentication. Practical implication: teams need authoritative identity inventory and entitlement visibility before zero trust can operate as designed.

Practical implication: teams need authoritative identity inventory and entitlement visibility before zero trust can operate as designed.

Valid credentials and stolen passwords as the real entry path

The article emphasises that attackers increasingly use valid credentials rather than overt exploits. That matters because zero trust architectures often assume that authentication and access policy can distinguish legitimate use from abuse, yet stolen passwords and privileged credentials already satisfy many front-door checks. When identity proofing, session control, and privilege limits are weak, the attacker does not need to bypass the system, only to appear normal inside it. That is why credential abuse keeps showing up as a dominant breach pattern. Practical implication: identity governance must treat credential reuse and privilege exposure as operational threats, not just account hygiene issues.

Practical implication: identity governance must treat credential reuse and privilege exposure as operational threats, not just account hygiene issues.

Why tool fragmentation creates blind spots in identity governance

The article notes that enterprises often run dozens of identity and security tools, each solving a narrow part of the problem. Fragmentation makes it hard to connect accounts, permissions, authentication events, and privilege changes into one enforcement model. In zero trust terms, that means the organisation may have multiple local controls but no unified answer to a simple question: who has access to what, right now, and why? When tools do not share a consistent identity context, policy drift and blind spots accumulate quickly. Practical implication: practitioners need a joined-up identity control plane rather than isolated point products.

Practical implication: practitioners need a joined-up identity control plane rather than isolated point products.

Threat narrative

Attacker objective: The attacker seeks to blend into normal access patterns long enough to reach privileged systems and cause material compromise.

1. Entry begins when attackers use stolen passwords or other valid credentials, which lets them pass routine authentication checks without triggering obvious perimeter alarms.
2. Escalation occurs when privileged credentials are compromised, allowing the attacker to move beyond a low-value account into higher-impact administrative or operational access.
3. Impact follows when the abused identity can reach sensitive systems under the cover of normal access, making the breach look legitimate until damage is already underway.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity sprawl is now the limiting factor in zero trust. Zero trust assumes that the identity surface is knowable, continuously verifiable, and governable. That assumption weakens when organisations manage millions of identities across humans, machines, developers, service accounts, and AI systems, because the control problem shifts from policy design to identity inventory fidelity. Practitioners should treat identity sprawl as a programme constraint, not a background condition.

Audit-ready identity programmes are not the same as abuse-resistant identity programmes. The article captures a familiar gap: controls designed to satisfy assurance checks often fail under live credential abuse. This is exactly where IAM, PAM, and NHI governance must be judged on runtime enforcement and privilege containment, not on documentation completeness. The practitioner implication is that compliance posture cannot be mistaken for operational resilience.

Continuous verification becomes fragile when the identity estate is fragmented. Zero trust only works when the system can connect authentication, entitlement, and privilege context in time to make an access decision. Tool silos break that chain by splitting identity knowledge across consoles and teams, which leaves gaps in who can act, where, and under which privileges. The field should read this as a governance problem as much as an architecture problem.

Valid-credential abuse is a governance failure, not just an attacker technique. If an environment still depends on passwords, broad privileged access, or poorly bounded service accounts, then the attacker is simply using the organisation's own trust assumptions against it. That is why the decisive issue is not only detection of compromise, but reducing how much access a valid identity can carry when it is abused. Practitioners should re-centre zero trust on identity containment.

Identity blast radius should become a first-class design metric. The strongest named concept in this article is the identity blast radius: how much reach any one compromised identity can exercise before controls intervene. In sprawling environments, that blast radius expands faster than teams can review it unless privilege is tightly bounded and continuously revalidated. The practical conclusion is straightforward: measure and shrink reach, not just count identities.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: Zero Trust Identity Guide

What this signals

Identity blast radius: the useful metric here is not how many identities exist, but how far any one identity can reach if it is abused. That shifts programme design toward privilege containment, entitlement quality, and continuous revalidation rather than identity counting alone.

Zero trust programmes will keep stalling if agencies try to layer policy over fragmented identity ownership. The practical next step is to unify visibility across human IAM, PAM, and NHI governance so access decisions are made from one operational truth, not multiple partial views.

For practitioners

• Map the full identity estate Build an authoritative inventory of human, machine, service, developer, and AI identities, then reconcile it against active entitlements and authentication paths.
• Reduce standing privilege exposure Review privileged accounts and service identities for access that persists beyond task need, especially where credentials can be reused or replayed.
• Correlate identity signals across tools Link IAM, PAM, and security telemetry so authentication, privilege changes, and anomalous use are visible in one operational view.
• Measure identity blast radius Track how much access each identity can reach if credentials are stolen, then use that metric to prioritise containment work.

Key takeaways

• Identity sprawl is now a control problem, not just a scaling problem, because the number and variety of identities can outrun the architecture meant to govern them.
• Valid-credential abuse remains a dominant breach path, which means authentication success alone is not evidence that access is safe.
• Zero trust initiatives will only hold if organisations reduce standing privilege, unify identity visibility, and measure blast radius as a governance metric.

Key terms

• Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.