Gartner’s digital identity cycle shows identity security converging

At a glance

What this is: This analysis argues that Gartner’s 2026 digital identity cycle points to convergence across identity visibility, posture management and threat detection, with AI agents and workloads accelerating the shift.

Why it matters: IAM, PAM and NHI teams need a shared runtime model because fragmented visibility and response leave identity-driven attacks and non-human access decisions harder to govern.

By the numbers:

• Two of the top four initial access vectors are identity-related exploits, according to Verizon’s 2026 Data Breach Investigations Report cited by Silverfort.

Context

Gartner’s 2026 Hype Cycle for Digital Identity is about where digital identity capabilities are maturing and where they are converging into a single operating model. The key governance problem is that identity visibility, posture management and threat detection are still too often treated as separate workstreams, even though attackers and AI-driven systems now move across them as one chain.

For IAM and NHI practitioners, the practical question is no longer whether to invest in visibility, hardening or detection first. The article’s central claim is that the control boundary is shifting to runtime identity decisions, where access context, policy and response need to work together across human, workload and agentic identities.

Key questions

Q: How should security teams implement runtime identity controls across hybrid environments?

A: Start by placing policy at the access layer that sits above directories, clouds, and applications. Then use adaptive enforcement such as step-up checks, just-in-time access, and identity segmentation so risky sessions can be constrained in real time rather than discovered later in logs.

Q: Why do fragmented identity and device tools create more risk?

A: Fragmented tools create risk because no single system sees the full chain from identity to device posture to access decision. That leaves gaps where policy can be bypassed, evidence can be incomplete, and remediation slows down. In practice, the more control points you split, the more opportunities you create for drift and blind spots.

Q: What are the signs that identity posture management is not working?

A: Common warning signs include unknown identities, inconsistent ownership, privileges that survive role changes, and federation paths that nobody can explain. If teams only notice these issues during audits or incidents, the posture model is already behind the environment.

Q: What should organisations re-evaluate as AI agents become part of the workforce identity stack?

A: They should re-evaluate whether their current governance model assumes stable, reviewable access that belongs to a person. AI agents change the problem because they can expand reach across systems while remaining outside human-centric processes. A mature programme needs ownership, lifecycle handling, and enforcement mechanisms that apply to agent identities as well as people.

Technical breakdown

Why identity visibility has become the control foundation

Identity Visibility and Intelligence Platforms, or IVIP, are presented as the contextual layer that makes downstream action possible. Visibility here means more than inventory. It means knowing which identities exist, how they relate to each other, and how access is actually exercised across hybrid infrastructure. Without that context, posture tools can harden the wrong thing and detection tools can surface alerts without enough identity context to support a decision. In practical terms, visibility becomes the prerequisite for enforcing policy at runtime rather than after the fact.

Practical implication: unify identity inventory and access context before expecting posture or detection to reduce risk.

How runtime posture management differs from static access control

Identity Security Posture Management, or ISPM, shifts the focus from who has access on paper to how risky that access is in operation. The article frames this as the hardening layer in a see, harden, detect lifecycle. That matters because broad standing permissions create seams between policy design and actual access use, especially in hybrid estates where service accounts, legacy systems and AI-driven workflows coexist. The technical point is not just permission scope, but whether posture data is current enough to support enforcement decisions when access is exercised.

Practical implication: measure and reduce standing privilege based on live identity context, not periodic entitlement reports.

Why ITDR is moving from alerting to inline response

Identity Threat Detection and Response, or ITDR, is described as the stop layer because detection alone does not prevent misuse once authentication succeeds. The article highlights inline decisions such as MFA challenge, denial or session termination at the point of authentication, including paths that many tools struggle to cover, such as Kerberos, NTLM, LDAP and service accounts. That is the architectural shift: identity telemetry is no longer just for investigation, it is being used to decide whether access should be granted at all.

Practical implication: place enforcement as close to authentication as possible so identity detections can block access before it is established.

Threat narrative

Attacker objective: The objective is to turn identity fragmentation into durable access that enables movement, privilege escalation and harder-to-detect compromise.

1. Entry begins with phishing or credential abuse, which the article notes are among the top identity-related initial access vectors.
2. Escalation follows when fragmented identity context prevents teams from seeing how access relationships support lateral or vertical movement.
3. Impact occurs when attackers exploit those seams to move through hybrid identity infrastructure faster than separate tools can coordinate response.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity convergence is now the operating model, not a future state: visibility, posture and detection are collapsing into one runtime identity control loop because attackers already treat them as one. When identities, policies and response remain split, the security programme cannot make consistent access decisions at the moment risk appears. Practitioners should treat convergence as an architecture requirement, not a product category.

Runtime identity security is the new control boundary: the useful unit of control is no longer the static entitlement record, but the live access decision made when an identity attempts action. That shift matters across human IAM, workload identity and NHI governance because the same access context now needs to inform hardening and enforcement. The implication is that programme design must align around runtime context, not separate tool ownership.

AI agents accelerate the collapse of legacy identity assumptions: the article’s focus on AI agents and workloads is not a side theme, it is the leading indicator of where identity governance is headed. Traditional models assume access can be reviewed after assignment, but agentic and workload identities increasingly act through dynamic, context-sensitive permissions. Practitioners need to recognise that identity governance is becoming execution-time governance.

See, harden, stop is the right sequence for mature identity security: the value of IVIP, ISPM and ITDR is not their labels, but the control progression they represent. A mature programme must first establish complete identity context, then reduce exposure, then block malicious use inline. Teams that keep these as disconnected capabilities will preserve blind spots even while buying more tooling.

Identity security is converging because the threat surface is converging: human users, service accounts and AI-driven actors now operate in the same authentication and authorisation environment. That makes the boundary between IAM, PAM and NHI governance less about ownership and more about shared enforcement logic. The practical conclusion is that identity programmes need one control plane for context and response.

From our research library:

• Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
• Read next: Top 10 Agentic AI Identity Issues

What this signals

Identity convergence is becoming a programme design problem: teams should expect visibility, posture and response to be judged together rather than as separate capabilities. The strongest operating model will be the one that can connect identity context to enforcement before access is fully established.

AI agents will pressure identity programmes to move faster than annual review cycles: if access is created and consumed dynamically, periodic governance alone will not see enough of the risk surface. That pushes IAM, PAM and NHI owners toward runtime controls, shared telemetry and a common policy layer.

Identity blast radius: the useful measure is no longer how many identities exist, but how far a compromised or overprivileged identity can move before control catches up. That is the metric practitioners should watch as identity platforms converge.

For practitioners

• Converge identity visibility and response Map where visibility, posture and detection data live today, then identify the points where identity context is lost between teams or tools. Prioritise the hybrid paths where service accounts, legacy systems and AI-enabled workflows create the most blind spots.
• Inventory AI agents and workload identities Create a governed inventory of non-human identities, including ownership, scope and the access paths they use at runtime. Include reused human logins, service accounts and agent credentials in the same discovery process.
• Shift enforcement to the authentication moment Design response so that identity detections can trigger MFA, denial or session termination before access is established. Focus especially on paths that traditional controls miss, such as Kerberos, NTLM, LDAP and service accounts.
• Measure standing privilege as a control gap Review where broad standing permissions still exist and determine whether they can be replaced with context-aware decisions at runtime. Use this review to align IAM, PAM and NHI governance around one access model.

Key takeaways

• Identity security is moving toward one runtime loop that combines visibility, posture and threat response across human, workload and agentic identities.
• The article links this shift to a real-world problem space where identity-related access remains a leading entry path and fragmented tooling leaves exploitable seams.
• Practitioners need to align IAM, PAM and NHI governance around live context, because static access records no longer describe the control problem accurately.

Key terms

• Identity Visibility and Intelligence Platform: An Identity Visibility and Intelligence Platform is a layer that correlates identity data across multiple tools into one risk picture. It does not replace existing controls. It makes them more useful by connecting events, relationships, configuration, and posture so teams can prioritise what matters.
• Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.
• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Runtime Identity Security: Runtime Identity Security is the practice of protecting identities while they are actively being used by software, services, devices, or agents. It focuses on controlling authentication, authorization, secrets, and session behavior at execution time, so compromised credentials, excessive privileges, or abnormal identity actions can be detected and contained quickly.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.