TL;DR: Identity risk has shifted from a control problem to an enterprise exposure problem: the 2026 State of Identity & Access report says dormant accounts, orphaned logins, machine identities, and entitlement sprawl are driving modern breaches across industries, according to Veza. That makes continuous effective-permission visibility the real governance requirement, not periodic access reviews.
At a glance
What this is: This analysis argues that identity has become the primary enterprise control plane, with modern breaches increasingly exploiting dormant access, machine identities, and entitlement sprawl rather than malware or zero-days.
Why it matters: It matters because IAM, PAM, and review-based governance now have to keep pace with continuously created human and non-human identities, or practitioners will lose visibility into effective access.
Context
Identity risk now behaves like a control-plane problem rather than a point control problem. The article argues that organisations can no longer assume IAM, PAM, SSO, and MFA alone will keep pace when identities and permissions are created continuously across human hiring, contractor access, SaaS adoption, automation, and AI agents.
The governance gap is not only about authentication. It is about keeping an accurate view of effective permissions across human users, service accounts, tokens, workloads, bots, and AI agents as access accumulates faster than reviews, de-provisioning, and remediation can clear it.
Key questions
Q: How should teams govern identity when AI and business change move faster than access reviews?
A: Treat identity governance as a change-management control, not a periodic audit task. Re-anchor access approvals, role reviews, and ownership checks to major events such as AI deployments, restructures, and acquisitions so access decisions are validated while the environment is still current.
Q: Why do machine identities complicate identity governance more than human accounts?
A: Machine identities act continuously, at scale, and with delegated authority, so they cannot rely on manual review cycles or human pauses. They often outnumber human users and can trigger downstream systems automatically. That makes runtime enforcement, ownership, and revocation timing much more important than in traditional user IAM.
Q: What are the signs that entitlement sprawl is becoming a governance problem?
A: The warning signs are permissions with no clear owner, access that survives after a workload changes, and review processes that cannot explain why a grant still exists. When teams cannot answer what exists, who owns it, and when it should end, entitlement sprawl has already moved from inefficiency to control failure.
Q: Should organisations prioritise MFA and SSO improvements or authorisation visibility first?
A: If the main problem is uncontrolled access expansion, authorisation visibility should come first. MFA and SSO reduce login risk, but they do not reveal which identities can actually alter data, trigger workflows, or reach sensitive systems.
Technical breakdown
Why identity has become the enterprise control plane
Identity is the decision layer that determines who or what can act on data, applications, infrastructure, and cloud services. When permissions become the primary path to systems and records, identity governance becomes the real control plane because attackers no longer need code execution if they can inherit legitimate access. The article’s core claim is that the enterprise is now governed as much by entitlement state as by perimeter controls. That shift makes effective permissions more important than nominal role assignments.
Practical implication: Treat identity governance as an operational control plane, not a quarterly compliance exercise.
How machine identities expand the attack surface
Non-human identities include service accounts, API keys, secrets, workloads, bots, and AI agents. These identities often hold concentrated access to critical cloud infrastructure while remaining outside human onboarding and offboarding processes. The technical risk is structural: machine identities are durable, reused, and frequently less visible than employee accounts, so privilege can accumulate without clear ownership or lifecycle control. In practice, that turns NHI inventory and ownership into a prerequisite for trust, not a nice-to-have inventory.
Practical implication: Inventory machine identities with owners, permissions, and lifecycle state before you can govern their risk.
Why entitlement sprawl defeats legacy IAM processes
Entitlement sprawl happens when permissions become too numerous, too granular, and too persistent for existing governance workflows to explain or certify. Traditional IAM often tracks accounts and roles, but real risk sits in effective permissions, the rights that actually enable read, write, create, or delete actions on a resource. Once those effective permissions spread across nested groups, inherited roles, and app-specific grants, periodic access reviews lose fidelity and remediation trails become incomplete. That is why the article frames visibility, not just authentication, as the missing control.
Practical implication: Shift from account-centric reviews to continuous effective-permission analysis across every critical system.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity is now the control plane because permissions, not passwords, define operational risk. The article’s central point is that enterprise exposure now lives in entitlement state, not just authentication posture. Once effective permissions determine who can alter systems, move data, or trigger workflows, governance has to follow the permission graph rather than the login event. The practitioner conclusion is clear: identity risk management now belongs in core security architecture.
Machine identities create a governance gap that legacy human-centric IAM cannot close. Service accounts, API keys, secrets, workloads, bots, and AI agents do not pass through the same lifecycle checkpoints as employees. That means offboarding, review cadence, and owner accountability all weaken unless the programme explicitly models NHIs as first-class identities. The practitioner conclusion is that machine identity governance must be measured as a distinct control domain, not a side effect of user IAM.
Permission sprawl is the named concept that explains why visibility is collapsing. Permissions have become too abundant, too granular, and too persistent for periodic review cycles to keep the enterprise safe. This is not simply an administration burden. It is a governance boundary failure, because the organisation can no longer answer who can do what, where, and when with enough precision to manage risk. The practitioner conclusion is that the control objective has shifted from access certification to continuous effective-permission visibility.
The industry is moving from authentication maturity to authorisation maturity. The report suggests that stronger login controls do not resolve the core problem when access keeps expanding faster than governance can contract it. That puts authorisation decisions, entitlement hygiene, and real-time visibility at the centre of identity security strategy. The practitioner conclusion is that IAM programmes must be re-tuned around what identities can actually do, not only how they sign in.
Identity risk is now a business health indicator, not just a security metric. The article connects low identity control maturity to regulatory exposure, operational resilience, AI governance, and cyber-insurance pressure. That broadens the accountability model: unresolved identity debt affects billing, continuity, and assurance as much as it affects incident response. The practitioner conclusion is to treat identity governance as a board-relevant measure of operational control.
What this signals
Permission sprawl is the operational symptom, but effective-permission visibility is the control objective. Most IAM programmes still report on accounts and role assignments, yet the real risk sits in what identities can actually do inside business systems. Practitioners should expect the next wave of identity governance to measure entitlements as live risk state rather than static access records.
Identity programmes now have to govern three identity classes together: humans, NHIs, and AI agents. The article’s important signal is that each class creates permissions continuously, but only machine and agent identities routinely bypass human lifecycle gates. That means the programme has to reconcile governance across onboarding, remediation, and offboarding without assuming a human operator is always present.
Identity risk is increasingly a board-level resilience topic because it now reaches operations, regulation, and insurance. When identity becomes the control plane, weak entitlement hygiene can interrupt billing, physical infrastructure, and regulated workflows. Practitioners should prepare for more scrutiny on access evidence, revocation speed, and who owns the effective permissions that keep critical services running.
For practitioners
- Build an effective-permission inventory Map the permissions that actually enable create, read, write, and delete actions across critical systems, not just the roles or accounts attached to them.
- Establish NHI ownership and lifecycle control Assign owners to service accounts, API keys, secrets, workloads, bots, and AI agents, then track onboarding, rotation, review, and offboarding as a single lifecycle.
- Replace periodic reviews with continuous visibility Use ongoing entitlement analysis to detect permission drift, inherited access, and orphaned grants before they accumulate into uncontrolled privilege.
- Prioritise high-concentration machine access first Focus remediation on the small percentage of machine identities that hold disproportionate access to cloud infrastructure and sensitive systems.
Key takeaways
- Identity risk now sits in the permission layer, where effective access matters more than nominal accounts or roles.
- The article frames dormant accounts, orphaned logins, machine identities, and entitlement sprawl as the main drivers of modern exposure.
- Continuous effective-permission visibility is the practical response when identity creation outpaces governance and review cycles.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centers on machine identities holding too much access without enough governance. |
| NHI-01 — Improper Offboarding | Dormant accounts and unremoved access show lifecycle failure across humans and NHIs. | |
| Recommendation — Audit NHI privilege scope and reduce any identity that holds more access than its task requires. Enforce offboarding checks so stale accounts and machine identities lose access when ownership ends. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about knowing and governing effective permissions. |
| Recommendation — Continuously validate entitlements and authorizations instead of relying on periodic access reviews. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and orphaned access are central to the risk pattern described. |
| Recommendation — Centralise account lifecycle control so orphaned and dormant access can be detected and removed. | ||
| MITRE ATT&CK | TA0004;TA0008 — Privilege Escalation; Lateral Movement | The article links entitlement sprawl to escalation and movement opportunities for attackers. |
| Recommendation — Map overextended entitlements to privilege escalation and lateral movement paths in your detections. | ||
Key terms
- Effective Permissions: Effective permissions are the access an identity can actually use after role inheritance, scope, and policy are applied. In Azure AI environments, they often matter more than the assigned role name because inherited rights can widen access to data, logs, and secret stores.
- Entitlement Sprawl: The gradual accumulation of too many discrete permissions, often with overlapping access and unclear ownership. It makes access review noisy and offboarding fragile. Grouping entitlements into profiles is one way to reduce that sprawl, provided the groups are designed around real work patterns.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Identity Debt: Identity debt is the accumulation of unowned, over-permissioned, or poorly governed non-human identities that security teams cannot cleanly inventory or retire. It usually grows when experimentation outruns access governance, leaving service accounts and tokens active long after their original purpose has passed.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 28, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org