Identity at a breaking point as machine identities outpace control

At a glance

What this is: This is a Lumos analysis of how rapid machine identity growth is straining manual governance, access review, and approval workflows.

Why it matters: It matters because IAM, IGA, PAM, and NHI programmes now have to govern identities that scale faster than human review cycles and can widen attack surface faster than controls adapt.

By the numbers:

• Only 3.8% of organisations made it through the last year without an identity-related security incident, according to Lumos.
• Nearly 65% of companies, or 64.6%, saw three or more different kinds of identity-related incidents in the last 12 months, according to Lumos.
• 46% already have at least one machine identity for every three humans, according to Lumos.
• Only 4.5% of organisations currently trust AI to make even limited autonomous decisions, according to Lumos.

Context

Machine identity management is the discipline of discovering, governing, and reviewing access for non-human identities such as service accounts, APIs, and AI-enabled tools. Lumos argues that this part of identity governance is moving faster than the controls built to manage it, especially as machine accounts multiply and attackers exploit access rather than malware.

The article frames 2026 as a turning point because manual review processes are colliding with scale, stale entitlements, and incomplete context. That pressure affects NHI governance directly, but it also exposes how human IAM review models and emerging autonomous workflows depend on the same approval assumptions.

The source also links the governance problem to AI adoption, but the central issue is not just automation enthusiasm. It is the widening gap between identity volume, reviewer context, and the speed at which access is created, used, and abused.

Key questions

Q: What breaks when identity review is still manual in environments with many machine identities?

A: Manual review breaks when the number of service accounts, APIs, and AI-driven identities grows faster than the team can verify ownership, purpose, and necessity. At that point, access recertification becomes stale before it is completed, and risky entitlements remain active because reviewers lack enough context to make confident decisions.

Q: Why do stale entitlements create so much identity risk?

A: Stale entitlements extend access beyond the period when it is actually needed, which gives attackers more time and more privilege to work with. They also hide governance failure, because access that is no longer reviewed tends to stay active indefinitely. The risk is highest when stale access combines with high privilege or machine identities that are hard to monitor.

Q: What are the signs that machine identity governance is no longer keeping up?

A: Common signs include surprise certificate expirations, repeated manual renewals, inconsistent policy enforcement, and teams that cannot answer who owns a given key or trust anchor. If controls only produce occasional snapshots, the programme is already behind the pace of the environment.

Q: Should organisations move some identity decisions closer to runtime or issuance time?

A: Yes, when the identity can act quickly enough that a later review will not capture the relevant state. That is especially true for dynamic machine identities and autonomous workflows. Issuance-time controls and runtime guardrails are more effective than relying on a certification cycle to notice abuse after the access has already been consumed.

Technical breakdown

Why machine identity growth breaks manual review models

Machine identity growth changes the unit of governance from a person with a limited access set to a large, fast-changing population of service accounts, APIs, and tool identities. Manual identity governance relies on reviewers having enough context to approve or revoke access accurately, but that assumption weakens when one human hire can create many dependent identities and when those identities outnumber people by large margins. The result is not just more work, but less reliable decision quality across access reviews, stale entitlements, and dormant access checks.

Practical implication: move review and approval logic toward machine-readable policy and ownership metadata before backlog growth makes recertification ineffective.

How attacker behaviour maps to identity control gaps

The article’s attack examples point to access abuse rather than malware delivery. MFA fatigue, dormant access exploitation, stolen credentials, and insider misuse all work because an attacker can log in and use already-provisioned access. That means the control boundary is not the perimeter alone but the lifecycle of credentials, entitlements, and reviewer context. When identities persist without adequate context or timely review, they become available as an attack path even if the underlying systems are technically secure.

Practical implication: treat dormant accounts, stale entitlements, and overprivileged access as active attack paths, not administrative hygiene issues.

What autonomous identity changes in governance assumptions

Autonomous behaviour changes governance because the system can initiate action, select tools, and time execution without waiting for a human approval loop. That breaks the assumption that access can be assessed after it has been used for a while, because some privileges may be requested, consumed, and discarded within a single session. In that model, governance has to move closer to issuance and decision time, or the evidence needed for classic review processes simply never exists.

Practical implication: design governance around issuance-time controls and runtime guardrails for autonomous workflows rather than relying on later certification cycles.

Threat narrative

Attacker objective: The objective is to turn valid identity access into broad environment control, data exposure, or repeated identity-based compromise without needing traditional malware.

1. Entry begins with credential abuse, especially MFA fatigue, stolen credentials, or dormant access that still authenticates successfully.
2. Escalation follows when the attacker operates through already-provisioned access and abuses stale entitlements or insider-like permissions without deploying malware.
3. Impact occurs when the attacker uses legitimate-looking access to move through the environment, misuse tools, or trigger multiple identity-related incidents at once.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Machine identity scale has outgrown human-paced governance. The core problem is not simply that there are more identities, but that the identity estate is changing faster than reviewers can understand and approve it. When one human hire can imply many dependent machine identities, the control model needs inventory, ownership, and lifecycle precision that manual review does not naturally deliver. Practitioners should treat scale itself as a governance defect when review quality falls behind.

Access review processes are being asked to solve a problem they were not built for. The article shows that reviewers often lack enough context or visibility to make informed approval decisions. That is not just an operational frustration, it is a sign that recertification is being used as a compensating control for weak entitlement hygiene. Teams need to recognise that review backlog is a security signal, not an administrative queue.

Ephemeral identity trust debt is now a governance concept worth naming. The more quickly identities are created, delegated, and consumed, the more confidence organisations borrow from assumptions they have not verified. That debt shows up as stale entitlements, overprivilege, and approvals based on incomplete context. The practitioner conclusion is that trust in identity decisions must be earned earlier in the lifecycle, not recovered after the fact.

Autonomous decision-making collapses the old review cadence. Access review was designed for access that persists long enough to be observed and certified. That assumption fails when the actor can request, use, and release privileges within a single operational session. The implication is not merely faster review, but a redefinition of where governance happens and what evidence remains available.

The market signal is clear: identity governance is becoming runtime governance. The article’s mix of machine growth, AI adoption, and reviewer context gaps points to a category shift. Governance that stops at periodic certification will not cope with environments where access is fluid and attack paths are identity-native. Practitioners should expect policy, telemetry, and lifecycle orchestration to converge.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• The 2025 Gartner Machine Identity Management in a Hybrid, Automated AI World Survey showed that 32% of organizations use mostly automated methods to manage credentials and only 1% use fully automated methods.
• Read next: Ultimate Guide to NHIs

What this signals

Machine identity governance is shifting from periodic certification to continuous evidence collection. Access reviews only work when the organisation can still see who owns an identity, what it last did, and why it still exists. As machine identities proliferate, programmes that cannot maintain that evidence trail will increasingly certify uncertainty instead of access.

Identity review backlog is itself a control signal. When reviewers lack enough context to approve or revoke confidently, the programme is telling you that ownership, usage, and entitlement data are not being maintained at the speed of the environment. That is where NHI governance and human IAM operations start to converge on the same operational weak point.

AI and automation will not fix governance debt unless the underlying identity model is explicit. Teams that adopt automation without clarifying which identities are human, machine, or autonomous risk automating ambiguity. The practical shift is to define decision boundaries first, then automate only where the identity lifecycle is already observable and well-owned.

For practitioners

• Prioritise machine identity inventory Build a complete inventory of service accounts, API credentials, and AI-linked identities before attempting broader automation. Include ownership, purpose, expiry, and last-used context so review decisions are based on evidence rather than guesswork.
• Reduce reviewer context gaps Enrich access review workflows with last-used data, ownership, and business justification so approvers are not forced to certify blind. Where context cannot be established, flag the identity for deeper validation instead of default approval.
• Target dormant access and stale entitlements Treat accounts inactive for more than 90 days, especially privileged or machine identities, as active attack paths that need suppression, not just periodic review. Remove or quarantine access when the entitlement no longer has a clear operational owner.
• Move high-risk decisions closer to issuance For autonomous or highly dynamic workflows, place controls at issuance time through policy, telemetry, and runtime guardrails rather than depending on later certification cycles to catch abuse.

Key takeaways

• The article argues that machine identity growth is overwhelming manual governance, especially where reviewer context and ownership data are incomplete.
• Lumos reports that only 3.8% of organisations avoided an identity-related security incident last year, while 64.6% saw three or more incident types.
• The control response is to move identity governance closer to inventory, ownership, and issuance time, rather than relying on slow certification cycles alone.

Key terms

• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Dormant access: Dormant access is an entitlement that remains technically valid even though the subject no longer uses it for its intended purpose. In identity governance, dormant access is dangerous because it preserves privilege, complicates review, and often survives well past the business need that created it.
• Access Recertification: Access recertification is the periodic review of user or account permissions to confirm that access is still justified. It is useful, but it is not enough on its own because it reacts after entitlements already exist, which is why lifecycle governance must reduce the volume of exceptions before review time.
• Autonomous Identity: An access governance model where identity decisions are made continuously with policy and automation rather than only through periodic human review. It is meant to keep pace with dynamic apps, machine identities, and fast-changing permissions while still preserving auditability and accountability.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.