TL;DR: Discovery tools built into many PAM and IGA programmes still miss additions, removals, and permission changes between scans, leaving identity blind spots across cloud, on-premises, and hybrid estates, according to Hydden. Real-time identity visibility now sits at the centre of governance, because unmanaged accounts and stale privileges erode both control and compliance.
At a glance
What this is: This is an analysis of why PAM and IGA control breaks down when identity discovery is not continuous, with blind spots created between scans across complex environments.
Why it matters: It matters because IAM teams cannot govern what they cannot see, and unmanaged or stale accounts undermine both privileged access control and access certification.
Context
Identity discovery is the process of identifying and cataloguing every account that exists across cloud, on-premises, hybrid systems, applications and identity providers. In practice, that means knowing not only which identities exist, but also where permissions changed, where accounts were added, and where removals were missed.
The governance gap is that many PAM and IGA programmes still rely on periodic collection rather than continuous discovery. When additions, removals and privilege changes happen between scans, the control plane becomes stale, and the organisation is forced to govern an incomplete identity inventory.
That matters most where human and machine accounts are both expanding, because each one can become an unmanaged access path if discovery does not keep pace. The pattern is now common enough that visibility has become a prerequisite for control, not a reporting enhancement.
Key questions
Q: What fails when identity discovery only runs on a schedule?
A: Scheduled discovery fails when identity change is faster than the scan interval. Teams end up governing stale inventory, so dormant accounts, excess privileges, and new relationships can exist long enough to be exploited before the next review cycle exposes them.
Q: Why does poor data visibility create identity governance risk?
A: Because access governance depends on knowing what the identity can reach. If sensitive data is not visible, access reviews miss exposure, service accounts inherit unnecessary paths, and AI workflows can reuse data without clear policy boundaries. In practice, incomplete discovery turns identity control into educated guessing.
Q: How do teams know whether PAM and IGA are working across the full identity estate?
A: They should test whether discovery data is fresh enough to expose newly added accounts, revoked access and privilege drift before review cycles close. If the control only sees a subset of the estate, PAM and IGA are working as partial controls rather than enterprise governance. The key signal is whether identity changes appear in the control plane quickly enough to affect decisions.
Q: What is the difference between attack surface discovery and access certification?
A: Attack surface discovery finds what identities, secrets and entitlements actually exist, while access certification checks whether known access should remain approved. Discovery expands the inventory, certification reviews the inventory you already have. If discovery is incomplete, certification can only validate a partial picture and may miss the identities most likely to be abused.
Technical breakdown
Why periodic identity discovery leaves control gaps
Periodic discovery creates a sampling problem. If a PAM or IGA tool only queries systems on a schedule, it can capture the state of an account after the fact while missing the state transition that created risk. That is especially weak in hybrid estates where identities span identity providers, applications, APIs and local directories. The result is not only incomplete inventory, but also stale entitlement data that can mislead access reviews, privileged access controls and compliance reporting. Continuous discovery reduces the time between change and detection, which is what turns identity data into a control input rather than an audit artifact.
Practical implication: treat discovery cadence as a control variable, not a reporting setting.
How continuous discovery changes PAM governance
PAM is often described as vaulting credentials, but its real governance value depends on knowing which privileged identities exist in the first place. Discovery feeds that control by identifying privileged accounts created outside standard onboarding, tracking permission drift and surfacing accounts that should be vaulted or monitored. Without that layer, PAM protects a partial estate and may miss orphaned administrators, service accounts or remote access paths. The technical issue is inventory completeness, not just credential handling. Once privileged identities are continuously discovered, session control, auditing and access restriction can be applied to the full population instead of a manually maintained subset.
Practical implication: make privileged-account discovery a prerequisite for vaulting and session governance.
Why IGA needs real-time identity visibility
IGA depends on authoritative identity records to support joiner, mover and leaver decisions, access certification and policy validation. If discovery is delayed, those records drift away from reality, which means reviews are performed against yesterday's access state. That creates false confidence in certification outcomes and weakens compliance evidence. Event-driven capture and log analysis help close the gap by detecting permission changes as they occur, not only when a review is scheduled. In this model, discovery is the data layer that allows IGA to validate entitlements against current conditions instead of static snapshots.
Practical implication: anchor access reviews to current discovery data rather than to stale certification snapshots.
Threat narrative
Attacker objective: The objective is to exploit invisible or stale identities as access paths that the governance stack never fully inventories or controls.
- Entry occurs when new accounts, permissions or shadow identities are created between scheduled discovery cycles and never enter the control inventory.
- Privilege accumulation follows when stale or missed identities retain access that PAM and IGA do not govern in time.
- Impact arrives as poor identity hygiene, misconfiguration and blind spots that expose sensitive systems and weaken compliance evidence.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Malwarebytes breach 2021: SolarWinds attackers added a certificate to a dormant email security app's service principal at Malwarebytes and read internal email via Microsoft Graph.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity discovery is the missing control layer beneath PAM and IGA. PAM and IGA assume the identity estate is already known, but that assumption fails when accounts appear, change or disappear between scans. The result is not a tuning issue, but a structural visibility gap that weakens every downstream control depending on authoritative inventory. Practitioners should treat discovery as the prerequisite governance layer, not a supporting feature.
Blind spots in identity inventory are now a governance problem, not just an operational inconvenience. When cloud, on-premises and hybrid environments all contribute accounts and entitlements, periodic scans cannot keep pace with the rate of change. That creates stale access records, missed removals and incomplete privilege maps that undermine review accuracy. The practical implication is that identity governance must be evaluated by freshness as well as coverage.
Continuous discovery is what makes privilege control measurable. Without it, PAM can only govern the subset of accounts already known to the programme, which leaves orphaned privileged identities outside session monitoring and auditing. The same logic applies to IGA, where certification only works if the source data reflects the current state of access. Organisations should measure whether identity discovery is closing the time gap between change and control.
The naming of identity attack surface management reflects where the market is heading. The field is shifting from static inventory management toward a data layer that feeds existing IAM investments with live identity state. That does not replace PAM or IGA; it exposes where those programmes depend on incomplete inputs. Practitioners should expect identity governance to be judged increasingly on continuous visibility rather than periodic reconciliation.
Service account visibility remains the clearest proof point of the problem. When only 5.7% of organisations have full visibility into service accounts, the industry is signalling that machine and non-standard identities are still the hardest part of governance to operationalise. That matters because the same blind spots that affect service accounts also affect privileged and shadow identities. The implication is clear: visibility is becoming the baseline control condition for identity programmes.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Service Account Security Guide
What this signals
Identity discovery now functions as a control dependency for PAM and IGA. Programmes that still rely on periodic scans should expect blind spots to persist, especially where cloud, on-premises and application identities change faster than review cycles. The governance test is no longer whether the tool can report identities, but whether it can keep the identity record current enough to drive decisions.
Fresh identity state is becoming the new threshold for trustworthy governance. When access reviews, vaulting decisions and remediation workflows all depend on stale snapshots, the programme may look compliant while remaining blind to recent changes. Practitioners should watch for lag between identity change and control recognition as the clearest sign that governance is lagging behind the environment.
For practitioners
- Make discovery continuous Move identity discovery from periodic scans to continuous collection using API queries, log parsing and event-driven capture so additions, removals and permission changes are detected close to the time they occur.
- Use discovery to seed PAM coverage Use discovered identity data to identify privileged accounts outside the standard process, then verify which of those accounts are actually vaulted, monitored and subject to session auditing.
- Rebuild access reviews on fresh identity data Prioritise certification cycles using the identities and entitlements that discovery shows are current, not the records last exported by the governance system.
- Validate revocation and provisioning logic Check whether your grant and revoke processes still match the live state of cloud, on-premises and application identities, especially where shadow accounts or stale permissions are common.
Key takeaways
- Discovery gaps are now a governance failure mode because PAM and IGA cannot control identities they do not continuously see.
- The strongest evidence in the source is that additions, removals and permission changes are missed between scans across hybrid environments.
- Teams should treat real-time identity visibility as the input that makes privileged access control and access certification credible.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Missed removals between scans leave identities active after they should have been closed down. |
| NHI-05 — Overprivileged NHI | Discovery gaps hide accounts whose permissions drift beyond what PAM or IGA can see. | |
| Recommendation — Continuously reconcile discovered identities against offboarding events and revoke any account that outlives its owner. Map discovered privilege drift to overprivileged identities and reduce access scope before certification. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Account management depends on knowing which accounts exist across the estate at any point in time. |
| Recommendation — Tie account creation, change and removal workflows to continuously refreshed identity inventories. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about keeping access records current enough to govern entitlements. |
| Recommendation — Validate entitlements against live discovery data before decisions are made in PAM or IGA. | ||
| MITRE ATT&CK | TA0007;TA0008 — Discovery; Lateral Movement | Identity blind spots enable adversaries to find and move through accounts that governance missed. |
| Recommendation — Use ATT&CK discovery and lateral movement tactics to prioritise monitoring where identity visibility is weakest. | ||
Key terms
- Identity Discovery: Identity discovery is the process of finding and cataloguing every identity, entitlement, and access path across the environment. In NHI programmes it is foundational because hidden service accounts, tokens, and machine identities create governance gaps that certification and offboarding cannot close.
- Identity Attack Surface Management: The practice of identifying and reducing the identity-related paths an attacker can use to gain or expand access. It covers accounts, permissions, trust relationships, authentication settings, and administrative workflows, with special attention to the places where identity compromise can become enterprise-wide compromise.
- Identity Visibility: Identity visibility is the ability to see which identities exist, what they can access, and how those access paths relate across systems. In NHI programmes, it means correlating service accounts, tokens, certificates, and agents into one operational view so governance decisions are based on evidence, not assumptions.
- Privilege Drift: Privilege drift is the gradual gap between the permissions an identity was meant to have and the permissions it actually retains. In AI agent environments, drift grows quickly because roles are reused, tasks change, and lifecycle reviews often lag behind deployment velocity.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org