Identity intelligence is the missing layer in zero trust

At a glance

What this is: This is a Zero Trust analysis arguing that identity intelligence is the missing layer because organisations cannot secure identities they cannot continuously discover or govern.

Why it matters: It matters because IAM, PAM, and NHI programmes all depend on complete identity visibility, and blind spots around ownership, privilege, and remediation leave Zero Trust incomplete.

By the numbers:

• 87%+ of organisations experienced multiple identity-related breaches last year despite having Zero Trust initiatives in place.
• Most organisations cannot see 56% of their machine identities.

Context

Zero Trust is a security model that assumes breach and verifies access continuously, but it depends on knowing which identities exist, who owns them, and what they can reach. When discovery is incomplete, the model protects the perimeter and the login flow while leaving the identity estate itself partly unmanaged.

SPHERE’s article argues that identity intelligence is the missing layer because traditional Zero Trust programmes focus too heavily on authentication and network control. The governance gap is broader than visibility alone: without continuous analysis of human and non-human identities, remediation and accountability never fully enter the control plane.

That matters for programmes that already have IAM, PAM, and IGA in place. The article’s starting position is typical of current enterprise environments, where multiple tools exist but the identity picture remains fragmented across cloud, directories, and automation layers.

Key questions

Q: What breaks when machine identities are excluded from Zero Trust policy?

A: Zero Trust breaks when machine identities are excluded because service accounts and workloads often generate the highest-volume internal access. If those identities are governed differently from human users, attackers can exploit the gap through over-privileged service access, weak logging, or unmanaged integrations. The policy model becomes incomplete.

Q: Why do privileged service accounts increase data breach risk in Zero Trust models?

A: Privileged service accounts often hold broad, persistent access that bypasses the containment benefits Zero Trust is trying to create. If those accounts are not scoped tightly, an attacker who steals one credential can reach data paths, administrative functions, or adjacent systems that should have remained isolated.

Q: How do security teams know behavioral identity intelligence is actually working?

A: It is working when teams see fewer false positives, faster identification of credible anomalies, and better separation between harmless deviation and real threat. Strong programmes also show that correlation across behavior, access, and threat data leads to earlier intervention. If the system only creates more alerts, it is not delivering useful context or improving response quality.

Q: Why does identity hygiene matter more when organisations move to zero trust?

A: Identity hygiene matters because zero trust replaces location-based trust with identity-based access decisions. If permissions are stale, overbroad, or poorly tracked, the identity layer becomes unreliable and the perimeter weakens. In hybrid environments, that can create hidden exposure even when network controls look intact, because access decisions depend on the quality of identity data.

Technical breakdown

Why authentication-centric zero trust leaves identity risk behind

Traditional Zero Trust implementations often anchor verification at the point of login, network session, or device posture. That works for access decisions, but it does not solve identity discovery, ownership mapping, or privilege validation across the estate. If service accounts, API keys, cloud roles, and automation identities are not continuously inventoried, the security model is operating on partial truth. Identity intelligence adds the missing layer by correlating identity data across systems and keeping risk assessment current as identities change.

Practical implication: move identity discovery and ownership validation ahead of access policy enforcement so Zero Trust decisions are based on a complete identity inventory.

How machine identities expand the zero trust governance problem

Machine identities include service accounts, tokens, cloud roles, and other non-human credentials that often outnumber human users and are harder to track. They are frequently embedded in applications and infrastructure, which means ownership can be unclear and lifecycle events can be missed. In NHI governance terms, the problem is not just scale but unmanaged persistence: identities can remain active long after the team that created them has moved on. That is why visibility and lifecycle control are inseparable here.

Practical implication: classify and assign ownership to machine identities before they are granted privileged or persistent access.

What automated identity hygiene changes in practice

Identity hygiene is the operational side of identity intelligence. It covers stale account removal, credential rotation, privilege reduction, and ownership correction, all driven by policy and continuous analysis rather than manual review cycles. The article also highlights a key design point: remediation has to be safe, because automation that breaks production will be ignored. In practice, the architecture must combine detection, risk scoring, and controlled remediation so that cleanup happens at a pace the environment can absorb.

Practical implication: pair continuous remediation with impact modelling so identity cleanup can scale without disrupting core services.

Threat narrative

Attacker objective: The attacker seeks to exploit unmanaged identity surfaces to gain durable access and move laterally before defenders can discover the compromised account.

1. Entry begins with unmanaged identities that were never discovered or owned, including service accounts, tokens, and other machine identities that sit outside normal review cycles.
2. Escalation occurs when those identities hold privileged or sensitive access, allowing attackers to move from one exposed account to broader system access without triggering strong governance controls.
3. Impact follows when identity blind spots delay detection and remediation, increasing the blast radius of identity-related breaches across cloud, directory, and application layers.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity intelligence is not a supplement to Zero Trust. It is the governance layer that makes Zero Trust operational. A Zero Trust architecture can verify access decisions only after it knows what identities exist and what risks they carry. When visibility is fragmented, the control stack becomes more reactive than preventive. The implication for practitioners is that identity governance has to start with discovery, ownership, and classification, not with policy enforcement alone.

Machine identities are now a primary governance problem, not a niche infrastructure detail. The article’s emphasis on service accounts, API keys, OAuth tokens, and AI agents reflects a structural shift in enterprise identity estates. These identities are harder to inventory, more likely to carry privilege, and more likely to persist without active ownership. The implication is that NHI lifecycle control must be treated as core identity work, not a side stream for cloud teams.

Identity hygiene is the missing operational discipline inside many Zero Trust programmes. Continuous discovery, analysis, and remediation are what turn identity visibility into risk reduction. Without them, PAM, IGA, and IAM tools remain partial controls that do not converge into a complete governance model. The practitioner conclusion is that identity hygiene should be measured as a programme outcome, not assumed as a by-product of tooling.

Blast-radius control becomes the decisive metric when identity visibility is incomplete. The article shows that organisations can have multiple Zero Trust components in place and still fail if unmanaged identities remain reachable. That means the practical question is no longer whether Zero Trust exists, but how far a compromised identity can travel before ownership, privilege, and remediation catch up. Teams should evaluate containment, not just control presence.

Identity visibility and intelligence platforms reflect the market’s shift from point controls to connective tissue. The competitive direction is toward layers that unify discovery, risk analysis, and remediation across IAM, PAM, IGA, and cloud identity sources. That does not remove the need for those controls, but it changes how they are governed: the centre of gravity moves to correlation and lifecycle truth. Practitioners should expect their identity programmes to be judged on completeness, not tool count.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Why NHI Security Matters Now

What this signals

Identity blind spots are now a Zero Trust failure mode. When organisations cannot continuously discover human and machine identities, they are applying verification to only part of the estate. The practical signal for security leaders is that control coverage must be measured against the full identity footprint, not the systems already in the IAM stack.

Identity hygiene is becoming the programme-level control that separates visible identity estates from governable ones. In practice, that means classifying, owning, and remediating identities continuously instead of waiting for certification cycles. The organisations that succeed will treat identity intelligence as an operating model, not a reporting layer.

For practitioners

• Define a continuous identity discovery baseline Inventory human and non-human identities across directories, cloud platforms, databases, and infrastructure, then classify which ones are owned, orphaned, privileged, or stale.
• Map ownership for every privileged non-human identity Assign a validated owner to each service account, API key, token, and automation credential, and revoke access where ownership cannot be established.
• Prioritise remediation by identity blast radius Rank accounts by privilege, sensitivity, and cross-platform reach so the first cleanup pass targets identities that can cause the widest compromise.
• Automate safe hygiene workflows Use policy-driven remediation for stale accounts, excessive permissions, and credential rotation, but gate actions with impact modelling before execution.
• Measure identity hygiene as a Zero Trust KPI Track ownership, classification, protection, and compliance as ongoing metrics so programme leaders can see whether identity risk is actually shrinking.

Key takeaways

• Zero Trust initiatives do not fail only at the network edge. They fail when identities remain undiscovered, unowned, or too widely privileged to govern.
• The article’s scale signal is clear. SPHERE ties identity-related breaches to a visibility problem that many programmes still have not closed, especially for machine identities.
• Practitioners need to shift from control presence to identity completeness. Discovery, ownership, and safe remediation are the controls that make Zero Trust real.

Key terms

• Identity Intelligence: Identity intelligence is the layer that turns raw identity data into context about risk, usage, and privilege. It helps teams distinguish harmless access from materially risky access by linking identity records, entitlement patterns, and behavioural signals, which is essential when non-human identities scale faster than manual review.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Identity hygiene: Identity hygiene is the practice of discovering, normalizing, and enriching identity records so governance can rely on them. It reduces ambiguity across directories, platforms, and operational systems, and it makes access review and remediation possible at enterprise scale.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.