Identity governance is now the control plane for attack surface

At a glance

What this is: This is a governance-focused analysis of why identity governance has become central to securing modern attack surface, with the article arguing that visibility, lifecycle control and entitlement review now sit at the centre of defense.

Why it matters: It matters because IAM and IGA teams are being asked to govern human, machine and AI-driven access patterns that perimeter tools cannot see, which changes how risk, blast radius and lifecycle control must be managed.

Context

Identity governance is the control layer that answers who has access to what, where that access came from, and how quickly it can be removed. The article argues that as cloud platforms, remote work and AI-driven systems widen the attack surface, the old perimeter model no longer explains where risk lives.

For IAM and IGA teams, the practical problem is not just excess access. It is fragmented identity data across directories, cloud services, SaaS applications, service accounts and AI tools, which makes entitlement creep and blast radius impossible to judge with confidence.

The article’s starting position is typical of modern enterprises, not an edge case. Hidden access accumulation, orphaned accounts and unmanaged machine identities are now routine governance failures rather than exceptional hygiene gaps.

Key questions

Q: What breaks when identity attack surface governance is missing?

A: When identity attack surface governance is missing, organisations lose control over which credentials, tokens, service accounts, and delegated paths are still active. That creates stale access, weak revocation, and unclear ownership, which attackers can exploit through legitimate identity channels rather than noisy intrusion techniques.

Q: Why do dormant accounts and excessive entitlements increase breach risk?

A: They extend the time and scope in which valid credentials can be abused. If an account is inactive but still authorised, or if access is broader than current job need, an attacker or insider can operate with less friction and a larger blast radius than the business intended.

Q: How can organisations tell whether identity governance is actually reducing risk?

A: Look for faster revocation, fewer orphaned identities, higher-quality ownership data, and review decisions grounded in usage evidence rather than static lists. If access issues are still discovered late or remain unresolved after reviews, the programme is generating compliance artefacts but not governance outcomes.

Q: Why do machine identities need different governance than human accounts?

A: Machine identities lack the human anchors that make access reviews reliable, such as managers, HR events, and predictable offboarding. Their ownership is often ambiguous, their usage is hidden inside workloads, and their permissions can expand quietly. Governance must therefore rely on evidence, accountability, and lifecycle controls built for systems, not people.

Technical breakdown

Why entitlement creep becomes an attack surface problem

Entitlement creep is the accumulation of access that no longer matches current role or business need. In large environments, permissions spread across HR systems, directories, cloud accounts and SaaS tools, so no single team can reliably see the whole picture. That fragmentation is why the same identity can retain old access long after a role change or contractor departure. Once attackers obtain valid credentials, the value lies not just in the account, but in the connected privileges that were never removed. Identity governance turns that distributed access history into a controllable security problem instead of a forensic surprise.

Practical implication: build reviews around accumulated access and stale entitlements, not just current role assignment.

How blast radius is determined by identity relationships

Blast radius in identity security is the set of systems, data and workflows an identity can reach if compromised. The size of that radius depends on privilege depth, cross-system reach, service account reuse and whether the account can move across cloud and on-premises environments. Traditional security tools often see activity, but not the entitlement relationships that make the activity dangerous. Identity governance fills that gap by mapping which identities connect to which resources and which combinations create high-risk paths. That makes compromise analysis a governance question, not only a detection question.

Practical implication: map privilege paths before an incident so response teams can scope compromise quickly when an account is abused.

Why machine identities need the same lifecycle discipline as people

Machine identities such as service accounts, API keys, OAuth tokens, container workloads and bots are non-human identities that behave differently from employee accounts but still create governance obligations. They are often provisioned for a task, then left running indefinitely or reused across systems. That creates hidden persistence because the identity is still valid even after the work it supports is finished. When governance is automated across issuance, certification, rotation and revocation, machine identities stop being invisible infrastructure and become managed security objects. The control problem is lifecycle discipline, not just inventory.

Practical implication: extend lifecycle governance to machine identities with issuance, review, rotation and offboarding controls.

Threat narrative

Attacker objective: The attacker aims to turn a stale but legitimate identity into broad access that supports ransomware deployment, lateral movement and wider disruption.

1. Entry occurred through a contractor account that remained active six months after the contractor left, giving the attacker legitimate access to begin the intrusion.
2. Credential abuse then expanded the attacker’s reach because the account still carried permissions across multiple systems and environments.
3. Impact followed as ransomware spread across systems and the team had to reconstruct the blast radius while containment was still in progress.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is no longer a downstream control, it is the control plane for the attack surface. The article is right to shift the conversation away from network boundaries and toward identity relationships because access now defines exposure more directly than the perimeter does. Security teams cannot govern what they cannot enumerate, and that makes visibility the prerequisite for every other identity decision. The practitioner conclusion is simple: if identity data is fragmented, the attack surface is already larger than the control plane.

Entitlement creep is the operational symptom of governance that cannot keep pace with role change. The article’s examples show that access grows cumulatively across systems, while revocation is delayed or incomplete. That is not just an administration problem; it is a security architecture failure because old entitlements become standing exposure. The practitioner conclusion is to treat accumulated access as risk, not administrative residue.

Identity blast radius should be measured before compromise, not reconstructed after it. The article makes clear that lateral movement becomes far harder to contain when service accounts and privileged users span multiple environments. This is where identity governance and identity analytics intersect: one tells you what exists, the other shows what it can reach. The practitioner conclusion is to make blast-radius mapping part of routine governance, not incident forensics.

Machine identities have turned lifecycle governance into a real-time security discipline. Service accounts, API keys and workflow identities now behave like long-lived infrastructure unless governance forces issuance, review and revocation discipline. That means the classic assumption that identities are mostly human and slow-moving no longer holds. The practitioner conclusion is to govern machine identities with the same rigor as privileged human accounts, but at machine speed.

Visibility without continuous certification still leaves a residual control gap. The article correctly ties analytics to access certification because discovery alone does not remove risk. Organisations need the ability to identify risky entitlements and then remove them through a governed process, otherwise visibility becomes an inventory exercise. The practitioner conclusion is to connect discovery, review and deprovisioning into one operating model.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Access Reviews and Certification Guide

What this signals

Identity governance has become the practical boundary of attack surface control. As cloud, SaaS and AI-driven workflows multiply identities faster than teams can review them, security programmes need a governance layer that can enumerate, certify and revoke access across systems. Without that, the control plane lags the real exposure surface.

Orphaned accounts are not an isolated hygiene issue, they are a governance debt. The article’s contractor example shows how access outlives employment when lifecycle controls are manual or fragmented. Organisations that still rely on periodic cleanup will keep discovering that their perimeter is already inside the identity layer.

Blast-radius mapping is the missing step between visibility and response. Knowing who has access is necessary, but knowing what an identity can reach is what changes incident scoping, prioritisation and recovery. That shift makes identity analytics and certification part of security operations, not just administration.

For practitioners

• Map identity attack surface across all directories Consolidate identity data from HR, directories, cloud identity providers, SaaS applications and databases so security teams can answer who has access to what across the estate.
• Automate contractor and leaver deprovisioning Trigger revocation across cloud, SaaS and on-premises systems when employment or engagement ends, so orphaned accounts do not remain valid for months.
• Prioritise high-risk entitlement certification Use access reviews to flag excessive privileges, toxic combinations and role drift first, rather than treating all access as equally urgent.
• Model blast radius for privileged identities Document which service accounts and admin accounts can reach multiple environments, then use that map to drive incident scoping and review cadence.
• Bring machine identities into lifecycle governance Apply issuance, rotation, review and offboarding rules to service accounts, API keys, OAuth tokens and workflow identities instead of leaving them as unmanaged infrastructure.

Key takeaways

• Identity governance now functions as a control plane because modern attack surfaces are defined by access relationships, not only by network boundaries.
• The article highlights a visibility problem that many organisations still carry, with only 5.7% reporting full visibility into their service accounts.
• Teams need lifecycle governance, entitlement certification and blast-radius mapping to reduce exposure before compromise becomes a full breach.

Key terms

• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.