Forrester’s workforce identity landscape spotlights NHI and AI agent risk

At a glance

What this is: Forrester’s workforce identity landscape says identity security platforms now have to govern humans, NHIs, and AI agents together, with governance and posture management emerging as central use cases.

Why it matters: That matters because IAM, IGA, and PAM teams increasingly have to control non-human access paths, review entitlement risk, and prove lifecycle governance across mixed identity populations.

By the numbers:

• Forrester’s landscape covers 32 vendors globally.

👉 Read Linx Security's summary of Forrester’s workforce identity security landscape

Context

Workforce identity security is no longer just about human sign-in and access control. The article argues that modern platforms now have to govern humans, machines, and AI agents together, because identity sprawl is increasingly driven by non-human access that traditional IAM stacks were not built to understand.

The article’s core claim is that governance, posture management, and lifecycle control are becoming the practical centre of the category. For IAM, IGA, and PAM teams, that means the unit of control is shifting from the user account to the full identity estate, including service accounts, workloads, APIs, and agentic systems.

Key questions

Q: How should security teams govern service accounts, workloads, and AI agents together?

A: Treat them as governed identities with owners, lifecycles, and review requirements, not as infrastructure exceptions. The practical model is to inventory them, map privileges, assign accountability, and connect them to the same remediation and certification workflows used for human access. That is the only way to keep non-human sprawl from outrunning governance.

Q: Why do non-human identities create more identity risk than many IAM programmes expect?

A: Because they multiply faster than human accounts and often accumulate access without strong lifecycle controls. When service accounts, APIs, workloads, and AI agents are left outside normal governance, privilege creep and hidden access paths grow quietly until they become a material security problem. Identity sprawl is therefore a governance issue, not just an inventory problem.

Q: What do teams get wrong about identity security posture management?

A: They treat posture as reporting instead of decision-making. Visibility is useful only when it leads to action, such as removing excessive privilege, closing toxic access paths, or forcing review on identities that no longer fit their intended scope. If posture does not change the entitlement state, it is not reducing risk.

Q: What should organisations re-evaluate as AI agents become part of the workforce identity stack?

A: They should re-evaluate whether their current governance model assumes stable, reviewable access that belongs to a person. AI agents change the problem because they can expand reach across systems while remaining outside human-centric processes. A mature programme needs ownership, lifecycle handling, and enforcement mechanisms that apply to agent identities as well as people.

Technical breakdown

How workforce identity platforms unify governance, access, and analytics

Forrester’s definition points to a broader platform pattern: identity data sources, SSO, MFA, access management, and identity governance are being combined with analytics so teams can manage identity risk in one place. The important shift is that these systems are expected to do more than authenticate users. They must correlate entitlements, policy, and observed behaviour across multiple identity types. That makes identity security posture management part of the operating model, not a separate add-on. Practical implication: treat identity telemetry and governance evidence as a single control surface, not isolated tools.

Practical implication: treat identity telemetry and governance evidence as a single control surface, not isolated tools.

Why machine and AI agent identity management is now a governance issue

The article treats AI agents, service accounts, and workloads as first-class identities, which is the right framing. These identities are not just technical artefacts. They carry access, participate in workflows, and can widen attack paths if their lifecycle is not governed. The governance challenge is that their privilege patterns often expand faster than review processes can keep up. Practical implication: design access review, lifecycle, and remediation controls around non-human identities as operational identities, not as exceptions hidden in infrastructure teams.

Practical implication: design access review, lifecycle, and remediation controls around non-human identities as operational identities, not as exceptions hidden in infrastructure teams.

Identity security posture management is about fixing risk, not just finding it

The article describes a posture model built on graph-based visibility, excessive privilege detection, and remediation. That matters because visibility alone does not reduce identity risk. Teams need to identify toxic access paths, understand which entitlements are actually dangerous, and remove or constrain them without waiting for a separate audit cycle. In identity programmes, the hardest failures are usually not missing data but missing prioritisation. Practical implication: use posture data to drive remediation queues, not reporting decks.

Practical implication: use posture data to drive remediation queues, not reporting decks.

NHI Mgmt Group analysis

Identity governance is becoming the control plane for workforce identity security. The article reflects a market shift away from standalone IAM thinking toward unified governance across humans and non-humans. That is the right direction because access, lifecycle, and auditability now depend on whether teams can see the whole identity estate, not just employee accounts. For practitioners, the important conclusion is that governance programmes must be built to absorb machine identity at scale.

Machine and AI agent identity management is now a category-defining requirement, not an extension feature. NHIs are no longer edge cases tucked into infrastructure workflows. Once service accounts, workloads, APIs, and AI agents are treated as identities with real business reach, the governance surface expands into lifecycle, least privilege, and review discipline. Practitioners should stop treating these identities as exceptions and start governing them as the operational core of modern identity security.

Identity security posture management is the named concept that best captures this market shift. The article’s emphasis on graph visibility, risky access paths, and remediation shows that the category is moving from enumeration to prioritisation. A platform that can only report on entitlements does not solve the identity problem. The field is now converging on posture as the way to decide what gets fixed first, and practitioners should measure success by reduction in toxic access paths.

Traditional IAM assumptions are breaking under mixed identity populations. Access governance was designed for stable human identities with review cycles, not for always-on machine access and rapidly expanding AI agent reach. That assumption fails when non-human identities proliferate faster than recertification, offboarding, and privilege review can respond. The implication is that identity programmes must rethink what is being governed, because the old human-centric operating model no longer matches the environment.

The market is signalling convergence between IAM, IGA, PAM, and NHI governance. The article shows that the next workforce identity stack is no longer segmented by function. Practitioners should expect vendors and internal programmes alike to collapse the boundaries between identity administration, governance, posture, and machine identity control. The practical conclusion is to align operating teams around identity risk outcomes instead of product categories.

From our research:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
• From our research: Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• For a broader control baseline, review NIST Cybersecurity Framework 2.0 alongside the governance and posture questions raised here.

What this signals

Identity posture programmes will increasingly be judged by how well they absorb machine identities. Once NHIs outnumber human identities by 25x to 50x in modern enterprises, the control model has to move beyond periodic review and into continuous entitlement governance. Teams that still organise around employee access alone will miss the dominant source of identity sprawl.

Machine and AI agent identities need the same lifecycle discipline as human users, but with different operating assumptions. That means ownership, offboarding, and review must be tied to runtime access patterns rather than org-chart events. The practical signal for practitioners is whether remediation can happen fast enough to matter before privilege becomes embedded.

Identity security is converging on a posture-and-enforcement model rather than a reporting model. A programme that can see risk but cannot change access will not keep pace with mixed human and non-human populations. Use the Ultimate Guide to NHIs as a control baseline and map your current state against the NIST Cybersecurity Framework 2.0 functions that govern, protect, detect, and respond.

For practitioners

• Map every non-human identity to an owner and lifecycle Build an inventory that includes service accounts, workloads, APIs, and AI agents, then assign accountable owners, review cadences, and offboarding triggers for each identity class.
• Prioritise toxic access paths over raw entitlement counts Use graph-based visibility to identify privilege chains, lateral movement paths, and excessive access that materially increase breach impact, then rank remediation by exposure.
• Fold NHI review into existing governance workflows Add machine and AI agent identities to access certifications, exception handling, and remediation queues so they are not excluded from the same control loops used for human access.
• Measure posture by remediation, not inventory size Track how quickly excessive privileges are reduced, how many risky access paths are closed, and whether review actions actually change entitlement state.
• Separate observation from enforcement Do not stop at identity visibility. Ensure the programme can remove access, constrain policy, or trigger human review when an identity path becomes risky.

Key takeaways

• Forrester’s landscape reflects a category shift: workforce identity platforms are now expected to govern humans, NHIs, and AI agents together.
• The main risk is not just more identities, but more identity sprawl than legacy IAM and IGA models can review, prioritise, or remediate effectively.
• Practitioners should focus on ownership, lifecycle control, and posture-driven remediation for non-human identities before access paths become entrenched.

Key terms

• Workforce Identity Security Platform: A workforce identity security platform unifies identity administration, governance, access control, and visibility for people and machines. In practice, it connects IAM, IGA, and identity analytics so teams can govern access, detect risk, and remediate entitlement problems across a mixed identity estate.
• Non-Human Identity: A non-human identity is any machine or software identity used to authenticate and access systems, including service accounts, API keys, tokens, certificates, workloads, and AI agents. These identities need ownership, lifecycle management, and access review because they often outnumber humans and accumulate privilege quickly.
• Identity Security Posture Management: Identity security posture management is the process of finding and reducing risky identity conditions such as excessive privilege, toxic access paths, and misconfigurations. It goes beyond visibility by prioritising remediation actions that change entitlement state and lower the chance of identity-driven compromise.
• Agentic AI Identity: An agentic AI identity is the access identity used by an AI system that can take actions at runtime. When that system can choose actions, tools, and timing independently, governance must account for behaviour as well as credentials, because the risk is created by execution patterns, not just access tokens.

What's in the full analysis

Linx Security's full article covers the operational detail this post intentionally leaves for the source:

• How Linx maps its platform into Forrester’s core and extended use case categories
• The specific identity governance, posture, and machine identity capabilities the vendor says it is focusing on
• The vendor’s walkthrough of why AI-assisted access reviews and graph-based visibility matter in practice
• The report reference and the positioning context behind Linx’s inclusion

👉 Linx Security's full post covers the market framing, use case mapping, and category positioning in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance in your organisation, it is worth exploring.