TL;DR: Clarity Security says non-human identities have reached a 144:1 ratio, up 44% from 2024 to 2025, while AI-powered cyber attacks rose 47% globally and 78% of CISOs said the threat materially affects their business. Identity governance now has to cope with faster identity growth, unmanaged bots, and attack velocity that manual review cycles cannot absorb.
At a glance
What this is: This is a 2026 identity governance outlook that argues NHI sprawl, AI-driven attacks, and brittle authentication practices are forcing teams toward unified, context-aware controls.
Why it matters: It matters because IAM, IGA, PAM, and NHI programmes now have to govern human and machine access together while responding at machine speed, not review-cycle speed.
By the numbers:
- Non-human identities have reached a 144:1 ratio, according to Clarity Security.
- Non-human identities increased 44% from 2024 to 2025, according to Clarity Security.
- AI-powered cyber attacks increased 47% globally during 2025, according to Clarity Security.
- 78% of CISOs said AI threats are having a significant impact on their businesses, according to Clarity Security.
👉 Read Clarity Security's analysis of 2026 identity governance trends
Context
Identity governance is becoming a control-plane problem, not a ticket-processing problem. The article argues that manual, ticket-heavy workflows cannot keep up with the growth of non-human identities, AI-enabled attacks, and context-dependent access decisions in modern environments.
For identity teams, the pressure point is not just volume. It is the fact that humans, service accounts, bots, and AI agents now share the same governance surface, while legacy review and approval models still assume slow, stable, and easily enumerated access.
The article's 2026 outlook is typical of where many programmes are already headed: identity sprawl, faster adversaries, and a governance model that needs more automation and more unified visibility than most teams currently have.
Key questions
Q: What breaks when identity governance still depends on manual ticketing for NHIs?
A: Manual ticketing breaks when non-human identities outgrow the review process. Access accumulates faster than teams can certify or revoke it, so hidden entitlements, stale accounts, and overbroad permissions remain in place long after they should have been removed. The result is not just inefficiency. It is governance blind spots that attackers can exploit.
Q: Why do AI-driven attacks force changes in identity governance?
A: AI-driven attacks compress the time available to detect misuse and reduce access. That means identity governance must support faster signals, tighter privilege scope, and automated remediation. If approval cycles are slower than attacker movement, the governance model is already behind the threat.
Q: What are the signs that NHI sprawl is undermining access control?
A: Common signs include unmanaged service accounts, orphaned bots, unclear ownership, and permissions that have expanded beyond the original use case. If teams cannot answer who owns an identity, why it exists, and what it still needs, then the control environment is already behind the actual access state.
A: They need both, but for different jobs. Identity reviews tell you what exists and what should still be there, while attribute-based access control helps enforce real-time decisions based on context. The practical distinction is that reviews are governance, but ABAC is enforcement. Mature programmes use both to reduce drift and limit blast radius.
Technical breakdown
Why NHI sprawl breaks manual identity governance
Non-human identities include service accounts, bots, API-linked accounts, and AI agents that often accumulate access faster than teams can review it. When identities multiply across cloud, hybrid, and on-premise environments, ticket-based governance loses the ability to maintain a current inventory of who or what has access. That creates hidden entitlements, stale access, and unmanaged accounts that look low risk until they are used for lateral movement or privilege abuse. The technical issue is not just scale. It is that the governance process becomes slower than the identity lifecycle itself, so the review state is already outdated when it is acted on.
Practical implication: treat inventory completeness and entitlement drift as governance failures, not admin chores.
How AI-driven attacks compress response windows
AI-assisted attacks reduce the time between reconnaissance, credential abuse, and follow-on action. That matters because defensive teams still rely on human-in-the-loop triage for many identity decisions, including access changes, remediation approvals, and exception handling. Once attackers can move faster than review and ticket closure, the effective security boundary shifts from detection alone to automated response. In identity terms, standing access and broad entitlements become more dangerous because the attacker gets more done before anyone intervenes. The article's message is that governance has to operate at the same tempo as the threat, or it becomes purely retrospective.
Practical implication: automate high-confidence identity remediation paths so response does not depend on manual queue time.
Why traditional authentication is failing under deepfakes and voice cloning
Deepfakes and voice cloning weaken trust in familiar human verification cues. That changes authentication from a user-experience problem into a verification-design problem, because the attacker is no longer trying to guess credentials but to impersonate a trusted person well enough to trigger a process. The article points to policy and context-based controls, including ABAC, because a single identifier or voice check is no longer enough to justify access to sensitive systems. This is where identity assurance and transaction context must work together. The control gap is not awareness alone. It is relying on a verification method that can be convincingly simulated.
Practical implication: move sensitive approvals and data release to policy-backed verification, not conversational trust.
NHI Mgmt Group analysis
NHI sprawl has become a governance failure, not an inventory problem. The article's 144:1 ratio is less important than what it implies: identity estates now contain far more machine actors than manual processes were designed to supervise. When service accounts, bots, and AI agents outnumber human identities so heavily, the programme is no longer managing accounts, it is managing blind spots. Practitioners need to treat unified governance across human and non-human identities as the baseline condition, not a maturity upgrade.
The review cycle assumption is collapsing under AI-speed operations. Identity governance was designed for access that persists long enough to be reviewed, certified, and revoked. That assumption fails when AI-driven attacks and automated identities can create, use, and abandon access faster than a ticket can move through approval states. The implication is not simply more automation, but a different control model: governance must move to issuance time and continuous drift detection.
Identity-first security is now an operating model, not a slogan. The article is right to frame identity as the new perimeter because network boundaries do not explain access when the real trust decision sits in identity, context, and entitlement state. ABAC, unified control planes, and continuous monitoring only matter if they are used to make identity the place where enforcement happens. Practitioners should re-evaluate whether their current stack governs access centrally or merely records it after the fact.
Traditional authentication is losing its evidentiary value. Deepfakes and voice cloning do not just add a new phishing technique; they weaken the assumption that human-recognisable signals are reliable proof of identity. That is a human IAM problem with broad spillover into access governance, because trust in the person becomes trust in the process. The practical conclusion is that identity assurance must be anchored in policy, context, and transaction risk, not in what a caller or sender sounds like.
Identity data is becoming a strategic signal, but only if governance is trustworthy. The article's forward-looking point on business intelligence is valid because identity telemetry can reveal onboarding friction, access bloat, and app usage trends. But that only works when the underlying identity data is complete and current. Practitioners should treat identity analytics as a byproduct of strong governance, not a substitute for it.
What this signals
Identity governance is shifting from periodic certification to continuous control. The article's core signal is that manual reviews cannot keep pace with the rate at which identities and entitlements now change. Programmes that still centre on ticket queues will struggle to explain why their access state is current when the threat state is not.
Context-aware access is becoming the practical bridge between human IAM and NHI governance. ABAC and policy-based controls matter because they let teams enforce different rules depending on role, device, location, and request context. That same logic is increasingly relevant across humans, service accounts, and AI-assisted workflows.
Access drift is the operational symptom to watch. When permissions grow faster than ownership, review, or remediation, identity governance is no longer governing the full estate. Teams should watch for drift across apps, entitlements, and privileged paths as the earliest indicator that the control model has fallen behind.
For practitioners
- Implement unified identity governance Bring human and non-human identities under one governance model across cloud, hybrid, and on-premise environments so service accounts, bots, and AI agents are not managed in separate silos.
- Run nested entitlement reviews Inspect inherited and indirect permissions attached to NHIs so hidden access paths are identified before they become persistent attack surface.
- Deploy continuous drift detection Monitor for new identities, permission expansion, and access that no longer matches the intended role, then trigger automated remediation when drift appears.
- Shift sensitive approvals to contextual policy Use attribute-based access control and verification rules for high-risk requests so access decisions depend on context instead of human recognition cues.
- Standardise new app adoption Require identity and access standards before onboarding new applications or agents so shadow IT does not create unmanaged identities by default.
Key takeaways
- Manual identity governance no longer scales cleanly to environments where non-human identities and AI-driven attacks both move faster than review cycles.
- The article's 144:1 NHI ratio and 47% global increase in AI-powered attacks show why visibility and automation now matter as much as policy.
- Teams that want to reduce risk in 2026 need unified governance, continuous drift detection, and stronger contextual enforcement across human and machine identities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article repeatedly warns that service accounts and bots retain more access than they need. |
| NHI-08 — Environment Isolation | The article's cloud, hybrid, and on-premise governance problem is ultimately about keeping identities separated by context. | |
| NHI-10 — Human Use of NHI | The article discusses human-driven governance of machine identities and the need to keep those control paths distinct. | |
| Recommendation — Audit NHI entitlements for excess privilege and remove access that no longer matches business need. Isolate NHI trust domains so one identity cannot inherit access across unrelated environments. Separate human approval paths from machine identity execution paths to reduce misuse and ambiguity. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about managing permissions across changing identity estates. |
| DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | Continuous monitoring is one of the article's key recommendations for spotting identity drift in real time. | |
| Recommendation — Align permissions and authorisations to current business need and remove stale access as part of routine governance. Monitor identity and entitlement changes continuously so drift is detected before it becomes exposure. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI agents and automated bots in the article create privilege abuse risk when access outpaces governance. |
| Recommendation — Constrain agent identity privileges so runtime actions cannot exceed the access intended for the task. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
- Attribute-Based Access Control: Attribute-Based Access Control is a policy model that grants or denies access using attributes such as user role, device state, location, and application context. It replaces purely static role assignment with a decision process that can adapt to current conditions, provided the underlying attributes are trustworthy and well-governed.
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
What's in the full article
Clarity Security's full article covers the trend-by-trend operational detail this post intentionally leaves at the strategy level:
- The specific actions the vendor recommends for unified governance across human and non-human identities
- The article's practical examples of access drift, shadow IT, and unmanaged AI bots
- The vendor's discussion of how AI-driven attacks change response speed and remediation priorities
- The full comparison between identity-first security and legacy network-bound thinking
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org