Identity discovery is the missing control in strategic risk reduction

At a glance

What this is: This is a Delinea analysis arguing that identity discovery is the foundation of strategic risk reduction because hidden identities and access paths create the blind spots where breaches begin.

Why it matters: It matters because IAM, PAM, NHI and AI governance programmes cannot reduce exposure they cannot see, and discovery is what turns fragmented access data into actionable identity risk management.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.

Context

Identity discovery is the act of finding, classifying and tracking every identity across the environment, including humans, service accounts, workload identities, API keys, tokens, certificates and AI-driven agents. The governance gap is that many identity programmes still assume a central directory and stable boundaries, while modern environments generate identities continuously across cloud, SaaS and DevOps estates.

That assumption no longer holds in enterprise identity security. If teams cannot see what identities exist, what they can access and how they relate to each other, they cannot assess overprivilege, hidden inheritance or lateral movement exposure. The article frames discovery as the control that makes identity risk reduction measurable rather than aspirational.

Key questions

Q: What breaks when identity discovery is incomplete?

A: Governance breaks first, because you cannot certify, rotate, revoke, or offboard identities you cannot see. Incomplete discovery means some machine accounts, secrets, and agent privileges remain outside the control plane, which undermines review quality and exception handling. Teams end up managing a partial estate while assuming coverage is complete.

Q: Why does incomplete identity visibility increase incident-response risk?

A: Because investigators have to reconstruct who had access while under pressure, and any gap in account ownership or privilege history slows containment. The more the programme depends on manual reconciliation, the longer it takes to confirm whether an account was valid, misused, or left behind.

Q: How do teams know whether application-level identity discovery is working?

A: Look for reduced blind spots between application reality and governance records. If discovery is working, unmanaged accounts, bypass paths, and embedded credentials should become visible quickly, remediation queues should be prioritised by risk, and audit evidence should become easier to assemble without manual reconstruction.

Q: How can teams govern machine identities and AI agents in access reviews?

A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers. If a non-human identity can act on sensitive data, it needs a lifecycle owner and a removal path just like any other privileged account.

Technical breakdown

Why identity discovery changes the attack surface

Identity discovery is not inventory for its own sake. It is the control that reveals the difference between an identity existing and an identity being governable. In modern environments, identities are created programmatically, replicated across platforms and inherited through nested roles and trust relationships. That means the effective attack surface is not the count of accounts, but the network of access paths connecting them. Identity graphing matters here because it maps direct and indirect access, including escalation chains that conventional consoles hide.

Practical implication: build discovery around relationships and reachable access, not just account enumeration.

Why hybrid identity visibility fails in fragmented toolchains

Hybrid visibility breaks when PAM, IAM, cloud consoles and detection tools each hold only a partial view of identity state. A service identity can look controlled in one system while carrying excess permissions in another, and an AI agent can authenticate through one provider while inheriting access elsewhere. That creates false confidence because compliance in one plane does not equal containment across the estate. Identity discovery closes that gap only when it spans cloud, on-prem, SaaS and DevOps control points together.

Practical implication: reconcile identity posture across platforms before treating any one control plane as authoritative.

Why posture matters more than existence

Discovery becomes useful only when paired with posture analysis. Knowing an identity exists is weaker than knowing whether it is stale, unmanaged, overprivileged, non-vaulted or policy-breaking. The article’s deeper point is that risk reduction depends on classifying exposure, not merely counting identities. This is especially true for machine and AI identities, where short-lived or delegated access can still create large blast radius if privileges are broad or inherited.

Practical implication: evaluate each discovered identity for privilege, lifecycle state and policy deviation before prioritising remediation.

Threat narrative

Attacker objective: The attacker seeks to turn hidden identity relationships into broader access, lateral movement and higher-impact compromise.

1. Attackers often enter through compromised credentials or misconfigured permissions rather than a software exploit. Once inside, they exploit incomplete identity visibility to find accounts and roles the security team never fully mapped.
2. They then abuse excessive privileges, nested trust relationships and inherited access to expand reach across cloud and SaaS environments. The lack of a common identity plane makes lateral movement easier to hide.
3. The end state is broader access to sensitive systems and a larger breach impact than the original account would suggest. The real weakness is not the account alone, but the unseen relationships that connect it to the rest of the environment.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity discovery is the control that turns identity risk from conjecture into measurable exposure. When teams cannot see every identity, they cannot tell whether overprivilege is isolated, inherited or repeated across environments. That makes discovery the prerequisite for strategic risk reduction, not a supporting hygiene task. Practitioners should treat visibility as the baseline for every identity programme.

Identity graphing is the named concept that matters here: the attack surface is defined by how identities connect, not just by how many exist. Access inheritance, nested groups and cross-account permissions create escalation paths that conventional dashboards flatten. The implication is that identity governance must move from list-based inventory to relationship-based control.

The board-level question is no longer how many tools exist, but whether identity exposure can be explained in business terms. Gartner’s board-level concern framing reflects a broader shift: identity risk is now strategic because machine and AI identities multiply faster than manual review cycles can absorb. Practitioners need a common identity plane that supports risk, incident and compliance audiences at once.

Identity discovery should be understood as a governance amplifier rather than a detection add-on. Once identities are visible, teams can prioritise overprivileged accounts, remove shadow admins and quantify where access is drifting over time. That is how identity security becomes a discipline of reduction, not a collection of disconnected controls.

The strongest identity programmes will measure whether discovery coverage expands faster than identity sprawl. Human, machine and AI identities now coexist in the same operational estate, so risk reduction depends on continuous visibility across all three. The practitioner conclusion is simple: if discovery is incomplete, every downstream control remains partially blind.

From our research library:

• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Ultimate Guide to NHIs — Key Research and Survey Results

What this signals

Identity discovery must now be treated as an operating prerequisite, not a reporting feature. In estates where identities are created continuously across cloud, SaaS and DevOps, the governance problem is no longer whether controls exist but whether the organisation can see the identities those controls are supposed to govern. Discovery coverage is therefore the earliest indicator of programme credibility.

Service-account blind spots are a proxy for wider NHI blind spots. Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs. That scale of invisibility means privilege reviews, offboarding and blast-radius reduction are all starting from an incomplete map.

Identity blind spots reshape incident response as much as prevention. When access paths are hidden, response teams spend valuable time reconstructing relationships after compromise rather than containing them immediately. The programme implication is to make identity relationships queryable before an incident forces that work under pressure.

For practitioners

• Expand discovery across all identity classes Map humans, service accounts, workload identities, API keys, tokens, certificates and AI-driven agents into one inventory so that newly created identities are visible when they appear, not after review cycles catch up.
• Build an identity graph for access relationships Model direct and indirect access paths, including nested roles, trust links and cross-account permissions, so escalation chains and lateral movement paths are visible before they are abused.
• Prioritise posture, not just presence Classify each discovered identity for privilege level, lifecycle state, ownership and policy exceptions, then rank remediation by blast radius instead of by ticket volume.
• Measure discovery coverage continuously Track how quickly new identities are detected across cloud, SaaS and DevOps environments, and compare that against the rate at which identities are created or replicated.

Key takeaways

• Identity discovery is the control that turns identity sprawl into a governable risk picture rather than an unknown exposure field.
• The article’s central warning is that hidden identities and access relationships create the blind spots where compromise becomes harder to contain.
• Practitioners need continuous cross-environment visibility and relationship mapping before least privilege, rotation and detection can reduce risk effectively.

Key terms

• Identity Discovery: Identity discovery is the process of finding and cataloguing every identity, entitlement, and access path across the environment. In NHI programmes it is foundational because hidden service accounts, tokens, and machine identities create governance gaps that certification and offboarding cannot close.
• Identity Graph: An identity graph is a relationship map that connects identities, assets, data, and permissions so teams can see how access actually flows. In NHI programmes, it helps explain which agent is related to which owner, which system, and which policy boundary.
• Identity posture: Identity posture is the measurable state of who and what can access systems, data, and services at a given point in time. It covers human users, service accounts, applications, and external parties. Strong identity posture depends on visibility, entitlement accuracy, review cadence, and dependable offboarding.
• Common Identity Plane: A common identity plane is a unified view where human, machine, workload, and AI identities can be governed in context. It reduces fragmentation by bringing ownership, access, and posture into one model that supports risk reduction across multiple identity programmes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.