IAM is dead: why ICAM changes identity security

At a glance

What this is: Axiad argues that IAM is giving way to ICAM because passwords and weak MFA no longer hold up against modern identity sprawl and credential-based attacks.

Why it matters: This matters because IAM teams now have to govern credential issuance, rotation and revocation as first-class controls across human, machine and service identities.

Context

Identity security breaks down when authentication still depends on knowledge factors that can be guessed, phished or leaked at scale. In this article, the vendor argues that the discipline must move from password-led IAM to credential-led ICAM because possession factors are harder to counterfeit and easier to govern across modern identity estates.

The practical governance issue is lifecycle control. If credentials now carry more security weight than passwords, then issuance, update, revocation and scale management become the controls that determine whether identity programmes can keep pace with enterprise sprawl, machine growth and repeated breach conditions.

Key questions

Q: How should IAM teams handle shared passwords and shared credentials?

A: IAM teams should treat shared passwords as a control exception that increases risk and weakens accountability. If shared access is unavoidable, it needs a documented owner, tight privilege boundaries, frequent review, and a clear plan to eliminate it. The safer default is to move to individual accountability or privileged session controls.

Q: Why do credentials create less risk than passwords but more governance work?

A: Credentials are harder to guess or reuse than passwords, so they reduce the weakness of knowledge-based authentication. But they also multiply governance obligations because every certificate, key or token needs issuance, tracking, rotation and revocation. The security gain only holds if lifecycle operations keep pace with the estate.

Q: What breaks when credential management is not scaled with identity growth?

A: The control that breaks is revocation and update consistency. As identity volumes grow, manual processes leave stale credentials in circulation, create ownership gaps and widen the time window in which compromised access remains usable. In practice, unmanaged scale turns strong credentials into weak governance.

Q: What is the difference between IAM and identity governance?

A: IAM enforces access at runtime, while identity governance decides which access should exist in the first place and whether it remains appropriate. IAM handles authentication and permission checks. Governance handles policy, approvals, certifications, segregation of duties, and revocation. Both are needed, but governance is what makes access defensible to auditors and risk teams.

Technical breakdown

Why possession factors now matter more than passwords

Authentication rests on knowledge, possession and inherence factors, but the article's core argument is that knowledge factors have become the weakest link. Passwords are easy to steal, reuse and spray at scale, especially when breach corpora and phishing automation lower the cost of abuse. Possession factors such as certificates, hardware keys, passkeys and API keys are stronger because they bind access to something the subject has rather than something it remembers. That changes identity security from a secret-selection problem to a credential governance problem.

Practical implication: Shift design assumptions from password quality to possession-factor lifecycle control.

What ICAM changes in credential management

ICAM, as framed here, expands IAM by making credentials the centre of the identity model. The article adopts CISA's description of credential management as the set of practices used to issue, track, update and revoke credentials in a given context. That definition matters because it turns credentials into governed assets rather than incidental authentication artefacts. For practitioners, the technical question is no longer whether authentication is enabled, but whether every credential has inventory, ownership, expiry and revocation paths that can be executed consistently across identity types.

Practical implication: Treat credential inventory and revocation as mandatory control-plane functions.

Why scale becomes the new failure point

The article's second-order point is that stronger credentials create operational pressure at scale. If an enterprise has many identities per worker and a far larger machine identity estate than human users, then manual lifecycle handling will not keep up. The failure mode is not just weak authentication, but unmanaged credential volume, inconsistent update discipline and revocation lag across thousands of assets. ICAM therefore makes credential governance a scale problem as much as a security problem.

Practical implication: Design lifecycle automation for issuance, update and revocation before credential volume outpaces operations.

Threat narrative

Attacker objective: The objective is to turn weak identity authentication into durable access that can be reused against sensitive accounts, systems or data.

1. Entry begins when attackers exploit weak or reused passwords, often amplified by phishing, password spraying or leaked credential corpora.
2. Credential access follows when the attacker captures usable possession factors or finds environments that still depend on brittle knowledge factors.
3. Escalation occurs when the attacker uses the compromised authentication path to reach sensitive accounts, services or downstream systems.
4. Impact is achieved when access persists long enough to expose data, move laterally or sustain breach activity despite nominal MFA coverage.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ICAM is really a governance correction, not a naming exercise. The article shows that IAM failed where identity estates outgrew password-led assumptions and where breach conditions made knowledge factors too easy to steal or replay. Credential management now has to be treated as a lifecycle discipline, because issuance, tracking, updating and revocation are what determine whether authentication is defensible at scale.

Credential-led identity security changes the control boundary. Once credentials become the primary trust object, the security programme has to manage them as assets with ownership, context and expiry. That pushes identity architecture closer to workload governance and lifecycle operations than to simple access policy, which is why static IAM thinking no longer maps cleanly to current attack conditions.

Identity attack surface is now a credential inventory problem. When the estate contains far more machine identities than human users, the programme's risk is not only compromise but unmanaged sprawl. The practical implication is that governance must account for every credential class, because missing inventory is now equivalent to missing control.

Passwords broke the old trust model, and the replacement model is stricter. Possession factors reduce dependence on memorised secrets, but they also demand tighter ownership, revocation discipline and operational scale. The lesson for practitioners is that ICAM raises the standard for identity governance even as it improves authentication strength.

Credential management is becoming the unifying layer across human and machine identity. The article's shift from IAM to ICAM reflects a broader market truth: identity programmes now have to govern the artefacts that both people and systems use to prove who or what they are. That makes lifecycle control a shared discipline across the full identity spectrum.

What this signals

Credential-led governance changes the operating model. Teams that still measure identity security mainly through access policy are missing the control point that now matters most. Once credentials become the primary proof of identity, lifecycle operations become the place where risk is either contained or left to accumulate.

Machine identity growth makes ICAM unavoidable. The gap between human identity counts and machine identity counts means credential governance can no longer be designed around a small set of administrators and employees. Programmes need a separate control view for service accounts, certificates and API keys because their issuance and revocation behaviours do not match human access patterns.

For practitioners

• Map every credential class Inventory passwords, certificates, passkeys, API keys and machine credentials separately so you can govern each lifecycle explicitly.
• Define issuance and revocation owners Assign accountable owners for issuing, updating and revoking credentials across human, service and machine identities.
• Reduce password dependence Prioritise possession-based authentication for high-risk use cases where shared or reused passwords still create exposure.
• Automate credential lifecycle controls Use policy and workflow automation so credential tracking, update and revocation do not depend on manual follow-through at enterprise scale.
• Review machine identity sprawl Treat machine identities as a separate governance population because they now outnumber human identities in many environments.

Key takeaways

• IAM is no longer sufficient when password weakness, phishing scale and identity sprawl define the attack surface.
• ICAM shifts the centre of gravity to credential issuance, tracking, update and revocation across all identity types.
• Practitioners should treat credential lifecycle governance as the control that makes stronger authentication durable at enterprise scale.

Key terms

• Identity, Credential and Access Management: ICAM is an identity governance model that puts credentials at the centre of access assurance. It extends IAM by focusing on the full lifecycle of issuance, tracking, update, and revocation, which is especially important when machine identities and service credentials outnumber human users.
• Possession factor: An authentication factor that depends on control of a device or physical token. It is stronger when the secret cannot be exported or reused easily, because an attacker must obtain the item itself instead of only the stored credential value.
• Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
• Machine Identity Sprawl: Machine identity sprawl is the uncontrolled growth of non-human identities across teams, platforms, and business processes. It becomes a governance problem when identities are created faster than they can be inventoried, reviewed, rotated, or retired, leaving security teams with incomplete visibility and weak accountability.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.