Identity dark matter is widening the NHI governance gap

At a glance

What this is: This research shows that identity dark matter is now larger than visible identity in enterprise environments, leaving NHI governance and AI agent oversight exposed to unmanaged accounts and access paths.

Why it matters: IAM, IGA, and PAM teams need this because controls built around visible directories miss local accounts, hardcoded credentials, and application-native identities that autonomous systems can use immediately.

By the numbers:

• Invisible identity now outweighs visible identity across enterprise environments, 57% to 43%.
• 67% of non-human accounts are created directly within the application and remain unseen by IAM programs.
• 70% of enterprise applications contain an excessive number of privileged accounts.
• 36% of all credentials are hardcoded and in clear text within applications.

Context

Identity dark matter is the portion of enterprise identity activity that IAM systems do not see or govern directly, including local application accounts, hardcoded credentials, and unmanaged authentication paths. In this article, Orchid Security argues that the hidden layer is now larger than the visible layer, which means many programmes are measuring identity health from an incomplete control plane.

The governance gap matters most for NHI because service accounts, application-native identities, and other non-human credentials often sit outside directory-first controls. When AI agents enter the same environment, they inherit those blind spots and can use unmanaged access paths faster than quarterly review cycles can detect them.

The article frames this as a readiness problem for agentic AI adoption, but the deeper issue is structural. If an organisation cannot inventory where non-human access actually exists, it cannot prove least privilege, offboarding, or oversight for the identities already in production.

Key questions

Q: What breaks when application-native identities sit outside IAM visibility?

A: Joiner-mover-leaver, recertification, and offboarding controls lose coverage when accounts are created inside the application instead of the directory. That means access can persist without review, and governance teams may certify a clean population while unmanaged identities continue to operate in production.

Q: Why do hidden NHI and local accounts increase security risk so quickly?

A: They create standing access that bypasses the normal identity lifecycle, so revocation, rotation, and ownership checks happen late or not at all. When those accounts also carry elevated privilege, they become an easy path for misuse, lateral movement, or autonomous system abuse.

Q: What are the signs that identity governance is missing application-level accounts?

A: Look for applications that authenticate locally, credentials stored in clear text, orphaned accounts, or privileged access that never appears in directory records. Those are the signals that the identity model is incomplete and that governance is being applied only to the visible subset.

Q: How should teams prepare AI agents to use only governed access paths?

A: Start by removing unmanaged login routes, embedded secrets, and orphaned privileged accounts that an agent could exploit faster than a human reviewer can respond. Then validate that the agent can complete tasks only through identities that are inventoried, owned, and lifecycle-managed.

Technical breakdown

Why application-native identities evade IAM visibility

Traditional IAM assumes identities are created, authenticated, and governed through centralized control points. Application-native accounts break that model because they are created inside the application, authenticated locally, and never pass through the directory, so they do not appear in standard joiner-mover-leaver or recertification workflows. That is why the gap is not just operational but architectural: the control plane is external to the place where access is actually instantiated. Once those accounts exist, PAM and IGA only govern what they can see, not what they do not know exists.

Practical implication: Map where identities originate inside applications, not only where they authenticate.

How hardcoded credentials and local accounts create standing access

Hardcoded credentials and unmanaged local accounts create standing access because the secret or account persists independently of the corporate identity lifecycle. If the credential lives in code or configuration, rotation, revocation, and offboarding all become indirect and delayed. That creates a long exposure window in which the account can be reused, copied, or discovered by both attackers and autonomous systems. In practice, this is where NHI governance fails first: the organisation has an asset it cannot inventory cleanly, so it cannot enforce lifecycle control with confidence.

Practical implication: Treat embedded secrets and local accounts as governance defects, not just remediation items.

Why autonomous systems amplify unmanaged identity risk

AI agents do not need new privilege concepts to become dangerous. They inherit whatever credentials, side doors, and excessive permissions the environment already exposes, then select the shortest path to task completion. That changes the risk from static over-permission to dynamic privilege exploitation, because the actor can discover and prefer unmanaged paths in real time. For governance, the key shift is that visibility failure becomes an execution problem, not merely a reporting issue. Identity controls designed for human-paced review do not contain machine-paced decisioning.

Practical implication: Reassess where review-based controls assume a human operator is present between access and use.

NHI Mgmt Group analysis

Identity dark matter is not a visibility edge case, it is the operating condition many enterprises already run on. When 57% of identity is invisible and two-thirds of non-human accounts are born inside applications, the control gap is no longer theoretical. IAM programmes built around directory completeness are governing a subset of the real estate. The implication is that identity governance must start with discovery of the actual control surface, not with policy over the one that is easiest to measure.

Application-native identity creation is the named concept that explains why classic lifecycle governance keeps missing the target. If joiner-mover-leaver, recertification, and PAM workflows are anchored to centrally managed accounts, they will always miss identities instantiated locally in software. Those identities can accumulate privilege, persist after business use has ended, and never enter the governance queue. Practitioners should treat application-native identity creation as a design flaw in the identity model, not a niche exception.

Least privilege is being undermined by identity placement, not just by role design. The report’s 70% excessive-privilege figure and 57% bypass of centralized identity providers point to a governance pattern where access is granted in the wrong place and then left to age. That is a stronger signal than simple role creep because the enterprise is authorising through side doors it does not formally own. The practitioner conclusion is that privilege control has to be anchored to where the account actually exists and authenticates.

Agentic AI turns identity blind spots into an execution multiplier. Autonomous systems do not wait for quarterly reviews, and they do not respect the distinction between formal and informal access paths. They will select the shortest route to a task, which means any orphaned account, clear-text credential, or local login becomes an operational shortcut. The field implication is that AI readiness depends first on eliminating uncontrolled identity surfaces, because the agent will always inherit the environment as it is, not as policy describes it.

Identity dark matter is becoming a distinct governance risk category, not a subset of secrets management. The report connects invisible accounts, overprivileged applications, orphaned access, and hardcoded credentials into one systemic pattern. That matters because the failure mode is not one control breaking, but multiple hidden identities accumulating outside the accountability model. Practitioners should read this as a governance architecture problem spanning NHI, IGA, and PAM together.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide

What this signals

Identity programmes that rely on directory completeness are already behind the environment they think they govern. The more applications create their own identities, the less useful quarterly governance cycles become, because the real access paths live in places review workflows never reach.

Identity dark matter: hidden access, embedded credentials, and local authentication paths form a separate governance surface that must be discovered before it can be controlled. Once AI agents begin using those paths, the problem moves from incomplete reporting to uncontrolled execution.

The strongest signal for practitioners is not just more automation, but more unmanaged identity density. As autonomous systems scale, the organisations that can inventory application-native accounts and local logins will be able to govern agent behaviour; the rest will only be able to observe after the fact.

For practitioners

• Inventory identities at the application layer Build a discovery process for accounts, secrets, and authentication paths that are created inside applications and never appear in the directory.
• Classify hidden NHI as a governance population Separate local accounts, embedded credentials, orphaned accounts, and application-native service identities so they can each be governed on their own lifecycle terms.
• Eliminate standing privilege in unmanaged paths Review applications that authenticate locally or bypass the identity provider and remove excessive privilege before those pathways become the default access route.
• Treat hardcoded credentials as exposure events Find secrets stored in code or configuration files, rotate them, and remove any workflow that allows credentials to persist outside managed vaulting.
• Test AI agent access against the blind spot Before scaling agentic AI, check whether the agent can reach orphaned accounts, unmanaged login paths, or excessive privileges that human reviews have never touched.

Key takeaways

• The core risk is that enterprise identity is being created and used outside the control points that IAM and IGA were built to see.
• The report ties this to concrete exposure markers, including 67% of non-human accounts created inside applications and 70% of applications with excessive privileged accounts.
• Practitioners should treat hidden identity discovery as a prerequisite for agentic AI readiness, because autonomous systems will use unmanaged paths as soon as they exist.

Key terms

• Identity Dark Matter: Identity dark matter is the hidden mass of old grants, unused credentials, and inherited access that exists in an environment but is not actively understood. In NHI programmes it becomes dangerous because autonomous systems can discover and reuse it at machine speed.
• Application-Native Identity: An account or credential that exists inside a SaaS platform rather than only in the central IdP. These identities are often missed by SSO-only offboarding processes, so they require direct inventory, ownership, and deprovisioning controls within the application boundary.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.
• Toxic identity combination: A toxic identity combination is a cluster of overlapping access weaknesses that compound one another, such as an orphaned account with elevated privilege or a local account backed by clear-text credentials. The term is useful because the risk comes from the combination, not any single flaw in isolation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.