TL;DR: Gartner’s 2021 security trends analysis, as discussed by Axiad, argues that remote work made identity-first security the practical baseline while fragmented credential providers, lifecycle friction, and user workarounds continue to weaken enforcement. The real issue is not authentication variety, but governance that cannot keep pace with how credentials are issued, used, and retired.
At a glance
What this is: This article argues that identity-first security is now the practical baseline because credential sprawl, siloed providers, and lifecycle friction undermine enforcement across modern workplaces.
Why it matters: It matters because IAM teams must govern credential issuance, use, and retirement across human and non-human access paths without creating user workarounds that erode control.
Context
Identity-first security means designing access around identity control points rather than treating authentication as a single, uniform step. In this article, Axiad uses Gartner’s 2021 trend analysis to argue that remote and hybrid work turned that model from a concept into an operational requirement.
The governance problem is credential sprawl: multiple authentication methods, separate management planes, and different lifecycle processes for apps, devices, VPNs, email, and workstations. When those controls do not align, users forget credentials, IT loses visibility into issuance and offboarding, and security policy starts to compete with usability.
The article’s central claim is not that organisations need fewer credentials at any cost. It is that distributed work exposes the cost of fragmented credential governance, especially when teams try to centralise without covering every credential type they will need next.
Key questions
Q: How should IAM teams reduce credential sprawl without creating new silos?
A: Start by mapping every credential type, its owner, and its lifecycle process, then consolidate only where a single governance model can cover issuance, use, and retirement. The goal is not fewer authentication methods at any cost, but fewer disconnected control planes that create gaps and exceptions.
Q: Why does credential sprawl create more risk in hybrid work environments?
A: Hybrid work multiplies the number of places people need to authenticate, which increases the chance that credentials, policies, and support processes will diverge. When users move between office, home, cloud, and mobile workflows, fragmented governance makes lockouts, workarounds, and inconsistent enforcement more likely.
Q: What are the signs that access governance is failing to stop credential abuse?
A: Common warning signs include repeated failed logins, unusual access outside normal hours, excessive permissions, stale accounts, weak separation of duties, and privileged activity that is not reviewed or recorded. If access reviews are irregular or approvals are treated as a formality, governance is probably drifting out of control. Those gaps often appear before a breach becomes visible.
Q: What should organisations do when users start bypassing authentication controls?
A: Treat workarounds as a governance signal, not a user discipline problem. If people are bypassing controls to stay productive, security and IT should simplify the credential workflow, close the friction points, and make sure the approved path is the easiest path.
Technical breakdown
Why credential sprawl breaks identity-first security
Credential sprawl appears when a workforce depends on several authentication systems that each manage their own accounts, policies, and lifecycle steps. That fragmentation creates duplicated administration, inconsistent assurance, and no single operational view of who has which credential, where it is used, or when it should be retired. In practice, the problem is less about authentication variety than about governance fragmentation across the credential estate. If onboarding, support, and offboarding are handled separately for each method, the organisation inherits friction, blind spots, and policy drift. Practical implication: treat credential sprawl as a governance problem, not just a user-experience problem.
Practical implication: build a unified credential governance model before adding more authentication methods.
How workarounds emerge when security controls collide with usability
When access policies make everyday authentication too difficult, users look for the fastest way to get work done. That can mean bypassing approved processes, reusing patterns that reduce friction, or leaning on help desk intervention instead of stable self-service. The article ties those behaviours to the tension between security enforcement and productivity in distributed environments. Once users begin normalising workarounds, policy enforcement becomes inconsistent and risk increases even when the formal control set looks strong on paper. Practical implication: measure whether controls are being followed as intended, not just whether they exist.
Practical implication: design controls that users can follow without relying on exceptions and manual resets.
Why credential lifecycle management must cover every access use case
Identity-first security fails when credential management only covers today’s known access methods. Large organisations need authentication across on-premises apps, cloud services, mobile devices, email, VPNs, and workstations, and future use cases often appear before teams are ready for them. If the platform cannot support the full credential lifecycle, consolidation simply recreates fragmentation in a different form. The operational lesson is that centralisation only helps when it includes issuance, change, retirement, and expansion paths for new credential types. Practical implication: evaluate whether credential governance can absorb future access methods without reintroducing silos.
Practical implication: choose management models that can extend to new credential types without reintroducing silos.
Breaches seen in the wild
- Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Credential sprawl is the hidden tax on identity-first security. Once authentication is split across multiple vendors and lifecycle processes, organisations stop governing identity as a system and start administering exceptions. That is why the real failure mode is not authentication diversity itself, but the absence of one coherent control plane for issuance, use, and retirement. Practitioners should treat fragmented credential estates as an identity governance defect, not an inconvenience.
Usability pressure is a security control input, not a side effect. The article shows that users create workarounds when credential processes slow them down or make access unreliable. That means security teams are not just managing risk at policy design time, but also at the point where policy meets daily work. If controls are too cumbersome, the organisation effectively outsources enforcement to the user, which is not governance.
Future-proofing is the real test of consolidation. Centralising today’s credential set is only useful if the platform can absorb the next credential type without creating another island. That makes credential management a lifecycle problem, not a product-count problem. The practitioner conclusion is simple: consolidation only matters when it preserves coverage as the identity estate evolves.
Identity-first security works when onboarding and offboarding are governed as one lifecycle. A dispersed workforce increases the cost of partial control, especially where access is provisioned in one system and retired in another. The more separate the processes, the more likely it is that access outlives the business need. Security leaders should therefore align credential lifecycle governance with workforce mobility, not just login convenience.
What this signals
Credential sprawl becomes an operating-model problem once each authentication method carries its own lifecycle logic. Teams that centralise only the login layer still inherit separate issuance and retirement processes underneath, which means governance remains fragmented even after consolidation. The practical shift is to manage credentials as a lifecycle estate, not a collection of point tools.
Identity-first security fails when user convenience is treated as separate from enforcement. The article shows that workarounds appear when credential processes slow people down or require repeated manual intervention. For practitioners, that means the control design itself is part of the threat surface because inconsistent experience drives inconsistent compliance.
For practitioners
- Map every credential type in use Inventory passwords, MFA factors, device credentials, VPN access, application credentials, and any other authentication methods by owner, system, and lifecycle process.
- Align onboarding and offboarding workflows Make sure each credential source has a defined issuance, change, suspension, and retirement path that IT can execute consistently across the workforce.
- Measure help desk volume by credential friction Use support tickets to identify which credentials create the most lockouts, resets, and manual interventions, then fix the process that drives the calls.
- Test consolidation against future credential needs Check whether the chosen platform can support new credential types without creating a separate management silo later.
Key takeaways
- Credential sprawl weakens identity-first security when multiple authentication systems create separate lifecycle processes and inconsistent enforcement.
- The article ties fragmented credential management to user workarounds, help desk load, and weaker policy adherence in distributed workplaces.
- Practitioners need a unified credential lifecycle model that can absorb new access methods without recreating silos.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Credential sprawl often creates unmanaged access scope across multiple credential stores. |
| NHI-01 — Improper Offboarding | The article highlights offboarding difficulty when credential lifecycle processes are siloed. | |
| NHI-07 — Long-Lived Secrets | Siloed credential management makes it easier for access to persist beyond its intended need. | |
| Recommendation — Map fragmented credential estates to NHI-05 and reduce overlapping access paths across systems. Apply NHI-01 controls to ensure every credential source has a defined retirement path. Use NHI-07 to shorten credential lifetime and remove stale access from fragmented systems. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The piece is fundamentally about governing who can access what across multiple credential systems. |
| Recommendation — Apply PR.AA-05 to centralise entitlement review across all credential providers. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article focuses on account lifecycle friction and manual administration overhead. |
| Recommendation — Use CIS-5 to standardise account lifecycle handling across all authentication methods. | ||
Key terms
- Identity-first security: Identity-first security is an approach that treats identity as the primary control plane for managing risk. Instead of relying mainly on network or endpoint boundaries, it uses identity context to decide what can happen, when it can happen, and under what conditions. That model is especially relevant where privileges move across human, non-human, and agentic actors.
- Credential Sprawl: Credential sprawl is the uncontrolled accumulation of machine secrets, keys, and tokens across systems, teams, and environments. It usually starts with a single use case and ends with overlapping permissions, unclear ownership, and a larger attack surface than the organisation expected.
- Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
- Manual Workaround: A manual workaround is a temporary non-automated process used to keep a business function running when systems or applications are unavailable. It may rely on spreadsheets, phone calls, or paper-based approvals to bridge a disruption. Good recovery plans define these workarounds in advance so operations can continue at a minimal but functional level.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org