Forrester’s workforce identity landscape spotlights NHI and AI agent risk

At a glance

What this is: This is Linx Security’s read on Forrester’s 2025 workforce identity landscape, which spotlights NHIs and AI agent risk as central to the category.

Why it matters: It matters because IAM, IGA, and PAM teams now have to govern humans, machine identities, and autonomous access patterns in one operating model.

Context

Forrester’s workforce identity security platform view treats identity as a control plane for both human and non-human access, not just employee sign-in. That shift matters because service accounts, workloads, APIs, and AI agents behave like operational identities even when they are not people.

The article argues that identity sprawl, posture drift, and lifecycle gaps are now central governance problems. For teams responsible for NHI, autonomous access, or human IAM, the question is no longer whether identity security extends beyond users, but how far the governance model must stretch to cover them consistently.

Key questions

Q: How should security teams govern AI agents that use existing NHI credentials?

A: Treat every AI agent as a non-human identity with its own owner, scope, and expiry. Assign the minimum permissions needed, issue short-lived credentials where possible, and log every action the agent takes. Governance should focus on both access and behavior, because a valid credential can still be used in an unsafe way.

Q: How should security teams prevent orphan accounts in mixed human and machine identity environments?

A: Security teams should connect identity lifecycle events to authoritative source systems so joiner, mover, and leaver changes trigger timely deprovisioning. Reconciliation should verify that directories, applications, and privileged systems all match the intended owner state. Regular access reviews then catch accounts that survive role changes, contractor exits, or system migrations before they become standing risk.

Q: What breaks when lifecycle governance does not cover non-human identities?

A: Compliance reporting becomes incomplete because the organisation can no longer prove who or what had access, for how long, and whether that access was removed on time. Non-human identities often outlive human workflows, so leaving them out of lifecycle governance creates hidden exposure that audits eventually surface.

Q: How do organisations know if identity security posture management is working?

A: It is working if posture findings lead to measurable entitlement reduction, fewer stale accounts, and shorter remediation cycles. Dashboards alone are not enough. The signal is whether over-scoped access is being removed, reviewed, and tied back to accountable owners before it becomes an audit or breach issue.

Technical breakdown

Why workforce identity platforms now have to cover NHIs and AI agents

Workforce identity security platforms are being recast as unified control layers across identity data, SSO, MFA, access management, and identity governance. The technical change is not just scope, but behaviour: NHIs and AI agents create access that is issued, used, and forgotten differently from human access. That makes simple directory-centric control insufficient, because the platform has to reason about relationships, entitlement drift, and runtime usage. In practice, the governance problem becomes identity sprawl with operational consequences across applications, data, and infrastructure.

Practical implication: Practitioners should treat NHIs and AI agents as first-class governed identities, not exceptions handled outside the main identity stack.

Identity governance shifts from certification to decision quality

Traditional access review models often optimise for completion, not for decision quality. The article points to a more modern IGA pattern where reviewers need contextual recommendations, evidence trails, and meaningful privilege analysis instead of flat spreadsheets. That matters because review fatigue and poor role modelling create the illusion of control while excessive access persists. In identity governance terms, the important technical move is from static attestations to risk-informed review workflows that can explain why access exists and whether it still makes sense.

Practical implication: Security teams should redesign access reviews so reviewers see context, ownership, and entitlement risk, not just a list of accounts.

Identity security posture management depends on graph-based visibility

Identity security posture management links entitlement data, identity relationships, and application reachability into a graph that can surface excessive or toxic access paths. That is technically different from simple inventory, because the problem is not only who has access, but which combinations of access create risk. Once that graph exists, the platform can prioritise remediation instead of treating every misconfiguration equally. The article’s emphasis on posture management reflects a broader shift toward continuous identity risk detection rather than periodic governance snapshots.

Practical implication: Teams should build a complete entitlement graph so they can identify and remediate the access paths that matter most first.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Workforce identity security is becoming a governance model for mixed identity estates, not a human IAM extension. Forrester’s framing matters because it treats NHIs, machine access, and AI agents as part of the same operational identity surface as employees. That is the real category shift: access control now has to handle identities that never log in like people but still create business risk. The implication is that identity strategy, not just tooling, has to assume mixed estates as the default.

Identity governance is moving from administrative certification to evidence-driven control assurance. The market no longer rewards access reviews that simply close tickets or produce export files. It increasingly values the ability to explain access, prove ownership, and surface why a privilege should exist in the first place. That changes IGA from a compliance rhythm into a control-quality discipline, which is where mature IAM programmes are heading.

Machine and AI agent identity management is now a distinct governance domain, not a side feature of access management. Treating service accounts, workloads, and AI agents as first-class identities changes lifecycle expectations, review logic, and accountability boundaries. Agentic access blast radius: once autonomous systems can initiate and chain access across tools, the relevant question is no longer only who approved the account, but how far its effective reach extends. Practitioners need to align governance, posture, and detection around that blast radius.

Identity security posture is becoming the practical measure of whether governance is working. The article’s emphasis on drift detection and remediation reflects an industry reality: governance without prioritised remediation leaves toxic access in place. The market is moving toward programmes that can translate identity data into action, not just reporting. That means posture management is no longer a monitoring add-on, but part of the identity control loop.

The category is converging on one operating model for humans, NHIs, and AI agents. Forrester’s landscape signals that the boundary between workforce identity and machine identity is collapsing in practice. The implication for practitioners is that access governance, threat detection, and lifecycle management can no longer be designed in separate silos. The strongest programmes will unify policy, evidence, and remediation across all three identity classes.

What this signals

Agentic access blast radius: As autonomous and machine identities become normal operating actors, identity programmes have to measure effective reach, not just account counts. The practical test is whether the control stack can show ownership, usage, and remediation paths before access becomes business risk.

For practitioners, the signal is clear: governance, posture, and lifecycle management are converging into a single identity control loop. If those capabilities still live in separate teams, the operating model will lag the environment it is meant to govern.

For practitioners

• Treat non-human identities as governed workforce identities Inventory service accounts, workloads, APIs, and AI agents in the same governance model you use for people, with clear ownership and lifecycle status.
• Redesign access reviews for decision quality Add contextual entitlement data, business ownership, and usage evidence so reviewers can assess whether access still makes sense.
• Map identity relationships as a graph Connect identities, permissions, apps, and data paths so excessive access and high-risk combinations can be prioritised for remediation.
• Establish separate controls for AI agent access Define review, lifecycle, and risk-detection rules for agentic access that can change quickly and operate across multiple tools.
• Build remediation into the identity workflow Make it possible to remove risky entitlements from the same workflow that identifies them, rather than exporting findings into another queue.

Key takeaways

• Forrester’s landscape reflects a broader shift in which workforce identity now includes machines and AI agents, not only employees.
• The governance challenge is less about adding more reviews and more about improving the quality of identity decisions and remediation.
• Programmes that cannot map identity relationships and act on risky access will struggle to govern mixed human and non-human estates.

Key terms

• Workforce Identity Security: Workforce identity security is the control layer that protects employee access across hiring, onboarding, support, role change, and offboarding. It combines identity proofing, access governance, and recovery controls so an attacker cannot exploit business processes to obtain or restore trusted access.
• Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.