TL;DR: Hybrid working has expanded the identity perimeter, and Axiad argues that security teams need to manage users, machines, emails, documents, and verification flows together because 90% of IT leaders reported more cyberattacks after the pandemic. The core issue is that identity assurance fails when governance is fragmented across too many credential types and access paths.
At a glance
What this is: This is a hybrid-workforce identity governance article arguing that security fails when users, machines, communications, and proofing flows are managed in separate silos.
Why it matters: IAM teams responsible for human, NHI, and device identity need a single governance model because fragmented assurance leaves credential issuance, verification, and access control inconsistent.
By the numbers:
- 90% of IT leaders reported an increase in cyberattacks since the pandemic.
Context
Hybrid workforce identity risk grows when organisations treat people, devices, credentials, and verification as separate control planes. In this article, Axiad argues that remote work has expanded the identity perimeter and made identity assurance harder to sustain with fragmented controls.
The practical problem is not simply remote access. It is the need to verify who or what is requesting access, issue the right credential, and keep that assurance consistent as employees, machines, and documents all move across dispersed locations.
Key questions
Q: What should security teams do when IAM governance spans human and machine identities?
A: They should apply the same lifecycle discipline to both populations while preserving identity-specific review logic. That means ownership, offboarding, recertification, and entitlement scope must be defined consistently, even if the workflow steps differ between people and non-human identities.
Q: Why do non-human identities increase identity security risk in hybrid environments?
A: Non-human identities often persist longer than the workflows that created them, and their access is frequently less visible than human access. In hybrid environments, that creates standing privilege, weak ownership, and delayed offboarding, all of which expand the attack surface for credential abuse and lateral movement.
Q: What breaks when machine identities are not governed like first-class identities?
A: Access becomes persistent, hard to attribute, and easy to overextend across systems. Without lifecycle control, a service account or API key can survive long after its purpose changes, creating a standing credential risk that traditional human IAM reviews are unlikely to catch. The result is larger blast radius and weaker accountability.
Q: How should organisations reduce identity theft risk in digital onboarding?
A: Use higher assurance checks for anything that can change account control, move money, or expose sensitive records. Pair source-based verification with multi-factor authentication, and do not allow a single static identifier to confirm identity on its own. Strong onboarding is about reducing the chance that leaked data can be reused as proof.
Technical breakdown
Why hybrid work breaks identity boundaries
Hybrid work changes the identity perimeter because access is no longer anchored to a fixed office network or a single class of credential. Users connect from dispersed locations, devices are unmanaged relative to older perimeter models, and helpdesk interactions move remote. That combination pushes identity governance beyond password policy and into assurance across issuance, verification, and device trust. For non-human identities, the same pattern applies to machines, services, and authenticators that must be tracked and secured as they join and operate on the network.
Practical implication: map every identity type and access path before deciding which controls belong in the hybrid-work model.
Machine identity and PKI-based assurance
The article points to machine identities as a distinct control problem, not a side effect of endpoint growth. Mobile devices, servers, applications, and IoT devices need identification, authentication, certificate issuance, and encrypted communication to prevent falsified entities from joining the network. PKI gives the organisation a way to bind trust to a certificate lifecycle rather than to a device’s location or a user’s manual approval. That matters because machine trust breaks when identity is assumed instead of issued and tracked.
Practical implication: govern machine identity as a certificate lifecycle problem, not just as endpoint inventory.
Identity proofing and credential issuance trust
The article also makes verification upstream of access central to identity control. Identity proofing is the step that confirms a person, customer, or partner is who they claim to be before a credential is issued. In hybrid environments, the risk is not only authentication failure after issuance but weak assurance at the point of enrolment, where fraud, onboarding delays, and policy workarounds begin. That is why proofing, credential issuance, and access authorisation need to be aligned instead of handled by separate teams.
Practical implication: review enrolment and issuance flow together so weak identity proofing does not undermine later access controls.
Threat narrative
Attacker objective: The attacker aims to gain trusted access by exploiting fragmented identity assurance rather than by defeating a single control.
- Entry begins when remote users, machines, or external identities are accepted into the environment through inconsistent verification and credential issuance.
- Privilege expansion follows when disparate identity controls allow multiple credential types, trust signals, and access paths to coexist without unified governance.
- Impact occurs when phishing, impersonation, or unauthorised device access exploits the weakest identity boundary and exposes enterprise resources.
Breaches seen in the wild
- Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Hybrid work exposes an identity governance gap, not just an access problem. When users, machines, documents, and verification flows are controlled separately, each team optimises its own layer while the attacker needs only one weak handoff. The result is inconsistent trust across the lifecycle, from enrolment to authentication to ongoing use. Practitioners should treat the identity perimeter as a governed system, not a collection of disconnected checks.
Machine identity is now a core part of workforce identity strategy. The article correctly treats mobile devices, servers, applications, and IoT endpoints as identities that must be issued, authenticated, tracked, and encrypted. That aligns with the reality that hybrid work expands the number of non-human actors participating in access decisions. The governance implication is that device trust and workload trust can no longer sit outside the identity programme.
Identity proofing failure is an upstream control failure. If an organisation cannot reliably verify a person before issuing credentials, every later access control inherits that weakness. This is especially important in hybrid onboarding, where speed pressures encourage shortcuts and manual exceptions. The field should stop treating proofing as an administrative step and start treating it as the first assurance boundary.
Credential sprawl is a governance symptom, not an operational inconvenience. The article’s emphasis on simplifying issuance and management reflects a deeper truth: every additional credential class increases the chance of inconsistent policy, user workarounds, and helpdesk-driven exceptions. That is why holistic identity controls matter across human and non-human identities alike. Practitioners should design for one assurance model across all credential types.
Identity assurance breaks when the programme is organised around tools rather than trust decisions. The strongest insight here is that remote work forces organisations to rethink who is verified, what is trusted, and when that trust is rechecked. A holistic model makes those decisions explicit across human IAM, NHI governance, and device authentication. The next step is programme alignment, not another isolated control.
What this signals
Identity governance has become a hybrid-work programme issue, not a login issue. When remote employees, devices, and external parties all rely on different verification steps, the security team loses a coherent trust model. The practical response is to govern issuance, authentication, and revocation as one chain rather than as separate controls.
Machine identity deserves the same operational discipline as human access. If servers, applications, and IoT devices are not inventoried and bound to certificate lifecycle controls, trust becomes implicit instead of enforceable. That is where hybrid environments quietly accumulate risk.
Credential simplification and identity proofing are linked. Reducing helpdesk friction is useful, but it does not fix the upstream problem if identity was never verified strongly enough at enrolment. The stronger programme moves assurance earlier and makes it consistent across all identity types.
For practitioners
- Map all identity classes Inventory users, machines, applications, devices, and external identities under one governance model so each class has an explicit trust path, issuance owner, and access boundary.
- Treat machine identity as lifecycle-managed Bind device and workload trust to certificate issuance, inventory, renewal, and revocation so machine identities are tracked from joiner to leaver events.
- Tighten identity proofing before issuance Require stronger enrolment checks for employees, partners, and customers before credentials are created, and align that proofing step with downstream access policy.
- Reduce credential sprawl Consolidate how users manage hardware tokens, smartcards, mobile authenticators, and similar credentials so helpdesk workarounds do not become shadow governance.
- Enforce activation gates for access Require users to complete device activation, certificate renewal, or unlock actions before resuming work when policy drift or stale authentication state is detected.
Key takeaways
- Hybrid work widens the identity perimeter by forcing organisations to govern people, machines, and verification flows together.
- The main risk is fragmentation, where separate credential types and access paths create inconsistent assurance across the lifecycle.
- Teams should align proofing, issuance, and machine certificate governance under one identity programme to reduce trust gaps.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-9 — Service Identification and Authentication | Machine and application identities authenticating across hybrid environments fit this service-to-service control. |
| Recommendation — Use IA-9 to govern machine and service authentication across hybrid access paths. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Identity abuse and trust-path misuse are central threats in hybrid workforce compromise scenarios. |
| Recommendation — Map hybrid identity abuse to credential access and lateral movement to improve detection coverage. | ||
Key terms
- Identity Assurance: The confidence an organisation has that a person or system is truly who it claims to be before access or action is granted. In modern IAM, assurance depends on evidence quality, channel trust, and the strength of verification around high-risk decisions.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org