TL;DR: As enterprises accelerate digital transformation, unmanaged identities, orphaned accounts, and sprawl across hybrid environments are creating a blind spot that SSO and MFA cannot cover, according to SPHERE Technology Solutions. Non-human identities now outnumber human identities 82 to 1, making upstream hygiene and continuous evidence-driven monitoring central to IAM and PAM governance.
At a glance
What this is: SPHERE describes identity hygiene as the missing layer for tackling unmanaged identities, orphaned accounts, and NHI sprawl across hybrid environments.
Why it matters: IAM and PAM teams need to treat identity hygiene as an operational control issue, because SSO and MFA alone do not govern the lifecycle, scope, and evidence trail of non-human access.
By the numbers:
- Non-human identities now outnumber human identities 82 to 1, according to SPHERE.
Context
Identity hygiene is the discipline of keeping identity inventory, ownership, privilege scope, and offboarding evidence current across humans and non-humans. In this article, the security gap is not authentication at the front door but the accumulation of unmanaged identities and orphaned accounts after access has been granted.
For IAM and PAM programmes, that shifts attention upstream. Once hybrid environments and service identities are allowed to sprawl, point-in-time controls can validate a login but still miss stale entitlements, unowned accounts, and privileged access that no longer has a clear business owner.
Key questions
Q: What breaks when identity governance is missing from an IAM programme?
A: The main failure is entitlement drift. Access gets granted correctly at the start, then role changes, project endings, and staff departures create stale permissions that remain active. That weakens segregation of duties, complicates audits, and makes revocation dependent on manual follow-up.
Q: Why do unmanaged non-human identities create such a large security gap?
A: Unmanaged non-human identities create risk because they scale faster than manual review processes and often sit outside clear business ownership. Each service account, token, or automation credential can retain access after a system change, merger, or decommissioning. That makes the gap cumulative, not isolated, and it erodes confidence in both PAM and IAM governance.
Q: How can teams tell whether PAM is working on accurate identity data?
A: PAM is working on accurate identity data when privileged accounts, ownership records, and entitlement scopes match what is actually deployed across the environment. If reviews repeatedly uncover orphaned accounts, duplicate identities, or access that no one can explain, the problem is upstream identity hygiene, not the PAM workflow itself.
Q: What should security teams do when SSO and MFA are already in place?
A: Security teams should treat SSO and MFA as authentication controls, then add lifecycle governance for identities that exist outside user login flows. The next step is to inventory machine identities, assign owners, and verify offboarding evidence so access can be retired as systems change. That is how identity hygiene closes the gap left by login controls.
Technical breakdown
Why SSO and MFA do not solve identity hygiene
SSO and MFA strengthen authentication, but they do not inventory identities, prove ownership, or retire access when a system, vendor, or workflow changes. Identity hygiene is about the lifecycle surrounding access, not the act of signing in. That matters in hybrid environments where accounts can exist in Active Directory, cloud services, SaaS apps, and automation pipelines at the same time. If those identities are not reconciled continuously, a strong login experience can coexist with weak control over who or what still has privilege. The result is a control gap, not an authentication gap.
Practical implication: treat authentication as only one layer and measure whether identity ownership and entitlement data are current.
How NHI sprawl changes the IAM control model
Non-human identities include service accounts, tokens, API keys, and automation accounts that can accumulate faster than human users. Their access is often provisioned for systems rather than people, which makes ownership, review cadence, and retirement more difficult to govern. When NHI counts grow faster than the programme's ability to assign accountability, privilege visibility degrades and orphaned access becomes normal. In practice, that means the classic user-centric IAM model is no longer sufficient on its own. The control problem shifts from proving a person is authenticated to proving every machine identity is known, owned, scoped, and monitored.
Practical implication: extend IAM inventory and recertification processes to machine identities with explicit ownership and lifecycle status.
Upstream hygiene as the control that PAM depends on
PAM can only constrain what is already known, named, and assigned. If identity data is stale, privileged accounts persist after mergers, application changes, or team turnover, and the PAM programme is left managing symptoms rather than sources. Upstream hygiene means cleaning identity state before privilege review, so PAM decisions are based on accurate identity lineage and entitlement evidence. This is why evidence-driven monitoring matters: it replaces periodic reassurance with continuous verification of identity conditions that change faster than quarterly review cycles can capture.
Practical implication: feed PAM with current identity evidence so privileged access reviews operate on live ownership and entitlement data.
Threat narrative
Attacker objective: The objective is to preserve unnoticed access paths inside hybrid identity estates long after the original business need has changed.
- Entry begins when organisations create identities for systems, integrations, and migrations faster than they can assign durable ownership or retirement rules.
- Escalation follows as orphaned accounts and sprawling privileges remain active after business changes, giving non-human identities access beyond their original purpose.
- Impact occurs when legacy controls validate login events but fail to expose stale privilege, leaving hybrid environments with hidden access paths and weak accountability.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
- Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity hygiene is becoming the governing assumption behind modern IAM, not a cleanup task at the end of it. SSO and MFA authenticate access, but they do not prove that every identity still has a valid owner, purpose, and retirement path. That distinction matters because hybrid estates accumulate access faster than quarterly governance cycles can reconcile it. The practitioner implication is that identity hygiene has to sit upstream of access reviews, not downstream of them.
NHI sprawl exposes a governance model built around human cadence. Non-human identities do not wait for manual review windows, and their ownership is often diffuse across engineering, operations, and third-party integrations. The result is a growing population of accounts that are technically active but operationally ungoverned. The practitioner implication is that lifecycle controls for NHIs must be explicit, continuous, and evidence-based.
Upstream hygiene and PAM are not separate disciplines anymore. PAM cannot reliably protect privileged access if identity source data is stale, orphaned, or duplicated across systems. That creates a privilege blind spot where controls appear present but are working on incomplete identity records. The practitioner implication is that privileged access programmes need continuous identity state validation, not just stronger session controls.
Identity blast radius is the right concept for this problem. Once unmanaged identities and sprawling privileges exist across hybrid environments, every delayed offboarding, duplicate account, or unowned service identity widens the set of places an attacker or accidental misuse can reach. The issue is not only volume, but the compound effect of disconnected identity decisions over time. The practitioner implication is to reduce the reachable identity surface before focusing on policy refinement.
Continuous evidence is overtaking point-in-time assurance as the real compliance model. The article's emphasis on moving from effort-based assessments to evidence-driven monitoring reflects where governance is heading across IAM, PAM, and NHI programmes. Static reviews can show that a process happened, but they cannot show whether identity conditions stayed true after the review closed. The practitioner implication is to align compliance evidence with live identity telemetry, not retrospective paperwork.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Identity hygiene is becoming the missing operating layer for hybrid IAM programmes. Organisations that still treat identity governance as a periodic clean-up exercise will continue to miss the accumulation of stale access between reviews. The practical shift is toward live identity evidence, where ownership and entitlement state are checked continuously rather than assumed to persist after certification.
Machine identities are now large enough to distort governance assumptions built for humans. When NHIs outnumber human identities at this scale, recertification and PAM processes must account for accounts that are created, reused, and retired by systems rather than by employee lifecycle events. That changes programme design: identity lifecycle controls have to be explicit for NHIs, not inferred from human IAM patterns.
For practitioners
- Map every non-human identity to an accountable owner Create a live inventory of service accounts, automation identities, tokens, and integration credentials, then require a named business and technical owner for each one.
- Move identity hygiene upstream of PAM reviews Validate account ownership, entitlement scope, and retirement status before privileged access recertification so reviewers work from current identity evidence.
- Reconcile orphaned accounts across hybrid systems Search Active Directory, SaaS platforms, cloud services, and migration artefacts for identities that lack an owner, purpose, or current business sponsor.
- Replace periodic assurance with continuous evidence Track identity state changes between review cycles so stale access, duplicate accounts, and unrevoked privileges are visible before the next certification window.
- Separate authentication controls from lifecycle controls Use SSO and MFA for sign-in assurance, but govern ownership, rotation, recertification, and offboarding through separate identity lifecycle processes.
Key takeaways
- Identity hygiene is now a core governance problem because authentication controls alone do not reveal orphaned accounts or stale privileges.
- The scale issue is not theoretical, with non-human identities now outnumbering human identities 82 to 1 in the source article.
- IAM and PAM teams need continuous identity evidence, ownership mapping, and lifecycle control if they want to reduce hidden access paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Orphaned accounts and unmanaged identities are the central failure mode in this article. |
| NHI-05 — Overprivileged NHI | Sprawling privileges across hybrid environments are the specific risk being described. | |
| NHI-07 — Long-Lived Secrets | The article's concern with unmanaged access and stale controls aligns with long-lived machine credentials. | |
| Recommendation — Reconcile and retire non-human identities when ownership or business purpose is no longer valid. Review NHI entitlement scope and remove access that exceeds the current task or system need. Shorten credential lifetimes and bind machine access to explicit lifecycle events. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on whether identity permissions remain current across hybrid systems. |
| Recommendation — Maintain current authorization records for both human and non-human identities across the environment. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article is fundamentally about unmanaged accounts and account sprawl. |
| Recommendation — Inventory, review, and remove inactive or unowned accounts across all connected systems. | ||
Key terms
- Identity hygiene: Identity hygiene is the practice of discovering, normalizing, and enriching identity records so governance can rely on them. It reduces ambiguity across directories, platforms, and operational systems, and it makes access review and remediation possible at enterprise scale.
- Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
- Upstream Hygiene: Upstream hygiene is the work done before access data reaches downstream controls such as PAM, compliance reporting, or access reviews. It ensures the identity inventory, ownership metadata, and entitlement state are coherent enough that later governance decisions are based on current evidence.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or PAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 22, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org