Identity observability is the missing control in the 2026 DBIR

At a glance

What this is: This is an analysis of the 2026 DBIR’s identity-related patterns and the finding that organizations keep missing the identities behind shadow AI, credential abuse, third-party risk, and emerging machine-account exposure.

Why it matters: It matters because IAM, IGA, PAM, and NHI programmes cannot govern what they cannot continuously discover, correlate, and action across human, non-human, and emerging autonomous identity estates.

Context

The 2026 Verizon DBIR is not a product brief or a theory paper. It is incident data from thousands of real breaches, and this analysis argues that the common thread is identity observability: identities exist, are used, and are abused before governance teams see them.

In practical IAM terms, the problem is that shadow AI, credential leakage, third-party excess access, and machine-account sprawl all create identity events outside the control plane. Once those events are invisible, recertification, offboarding, and response workflows arrive too late to matter.

Key questions

Q: What breaks when identity events are invisible to IAM and SOC teams?

A: When identity events are invisible, recertification, offboarding, and incident response all start from stale information. That means a user, third party, service account, or AI account can retain access long after the risk is known. The failure is not only detection delay, but governance delay, because no team can action what it never saw.

Q: Why do credential leaks still lead to ransomware even after initial containment?

A: Credential leaks remain dangerous because they often persist as active access or reusable tokens after the first event is detected. If identity telemetry does not connect the leak to the account and its privileges, the organisation misses the bridge from compromise to later ransomware activity. The risk is persistence through unresolved identity state.

Q: How can security teams govern shadow AI accounts without losing control of identity risk?

A: Treat shadow AI as an unmanaged identity problem first. Discover the accounts through device, DNS, and authentication telemetry, then determine whether they should be brought into sanctioned SSO, reviewed as exceptions, or removed. The key is to govern the account lifecycle, not just the content or application being used.

Q: What should IAM teams prioritise when third-party access takes months to close?

A: They should prioritise ownership, active usage, and permission aging. If an external account remains active after a role, contract, or remediation change, it should be treated as a live governance defect. Long closure times usually mean the team lacks continuous visibility into who is still using what.

Technical breakdown

Identity observability as a control plane problem

Identity observability is the ability to continuously discover, correlate, and monitor identities across human accounts, non-human identities, and third-party access. It is not the same as logging authentication events. The DBIR patterns described here show why successful sign-in is not enough: an identity can be active, risky, and exploitable even when every login looks legitimate. Without continuous inventory and behaviour correlation, governance becomes reactive and partial.

Practical implication: build identity discovery and correlation into the control plane, not just the audit cycle.

Why credential abuse still drives breach progression

Credential abuse remains central because identity is how attackers persist and move after initial access, even when vulnerability exploitation opens the door. The distinction matters: exploitation may create entry, but identity misuse often determines escalation, lateral movement, and impact. That is why breach data continues to show credentials as a full-chain problem rather than only an authentication problem. Security teams that treat credentials as a perimeter control miss the operational reality of post-compromise movement.

Practical implication: govern credential exposure, reuse, and misuse as an attack-chain issue, not only a login issue.

Shadow AI and machine accounts widen the unmanaged identity surface

The article’s strongest forward-looking point is that personal AI accounts, service accounts, and machine identities are becoming the places where governance blind spots concentrate. These identities are often created outside standard joiner-mover-leaver processes, which means they can persist, accumulate privilege, and evade review. As AI tooling spreads, that unmanaged surface becomes a lifecycle problem as much as a security one. The risk is not only usage, but ownership, visibility, and offboarding failure.

Practical implication: inventory non-human and AI-adjacent identities before they scale beyond manual review capacity.

Threat narrative

Attacker objective: The objective is to turn unseen identity activity into durable access that supports data theft, lateral movement, or ransomware impact.

1. Entry begins when users authenticate to non-corporate AI accounts from corporate devices or when credentials are harvested through infostealer activity.
2. Escalation follows when those identities or credentials remain active, over-permissioned, or unreviewed long enough to support broader compromise.
3. Impact occurs when attackers or unauthorized users exploit the invisible identity path for ransomware deployment, data movement, or third-party abuse.

NHI Mgmt Group analysis

Identity observability is now a prerequisite for identity governance: recertification and offboarding cannot govern identities that never enter the inventory. The DBIR pattern across shadow AI, credential abuse, and third-party delay shows that visibility failure is the upstream control gap. The implication is that identity programmes must treat discovery and correlation as governance, not as a separate monitoring function.

Identity events are the real bridge between separate breach narratives: the report’s AI account usage, infostealer pipeline, and third-party remediation delays are different symptoms of the same condition. Each depends on an identity that exists outside the organisation’s effective control plane. Practitioners should read the DBIR as evidence that governance fragmentation, not only attack sophistication, is driving exposure.

Machine and service accounts are becoming the next unmanaged class: the article’s warning about agentic AI is not speculative language, it is a signal that NHI governance is expanding into AI-adjacent execution paths. Service and machine accounts already behave like operational dependencies, and they are now the identities most likely to inherit hidden privilege. The programme implication is that NHI governance can no longer stop at inventories; it must include runtime visibility and ownership.

Identity observability is the missing control because it changes what is actionable: a risk that cannot be seen cannot be prioritized, remediated, or certified. The industry’s habit of splitting DLP, IAM, PAM, and breach response into separate workstreams leaves identity signals stranded between teams. The practical conclusion is that organizations need one continuous view of identity state across creation, use, abuse, and retirement.

Shadow AI is an identity governance problem before it is a data loss problem: the article correctly reframes personal AI accounts on corporate devices as unmanaged identities, not merely unsanctioned tools. That framing matters because the control failure is lifecycle and entitlement visibility, not just content exfiltration. Security teams should therefore evaluate how far their IAM and NHI processes can see outside sanctioned SSO pathways.

From our research library:

• The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.

What this signals

Identity observability is becoming the connective tissue of IAM, IGA, PAM, and NHI programmes: the article’s real insight is that these disciplines fail when they operate as separate queues. When identities can appear outside the governance fabric, the programme needs continuous discovery and correlation before certification or offboarding can work.

Shadow AI should be handled as an identity lifecycle issue, not a tool-blocking exercise: once personal AI accounts exist on corporate devices, the challenge shifts to ownership, entitlement visibility, and retirement. Organisations that only police application use will miss the unmanaged identities that persist after the initial event.

Machine and service accounts will demand the same visibility discipline now applied to privileged humans: the article’s forward-looking warning is that agentic AI will amplify an already familiar NHI problem. That means practitioners should prepare for runtime identity state, not just periodic review, because the old review cadence will not surface fast-moving non-human access.

For practitioners

• Map unmanaged identity paths Inventory non-corporate AI accounts, shadow service accounts, and third-party identities that operate outside normal joiner-mover-leaver workflows. Prioritise identities that can access corporate devices, shared SaaS, or production data without entering your standard governance process.
• Correlate credential events to breach risk Link infostealer detections, leaked credential indicators, and unusual authentication patterns to the owning identity and business context so a credential event becomes an actionable security signal rather than an isolated alert.
• Review third-party privilege aging Track how long external accounts remain active after scope changes, contract changes, or remediation findings, and treat long-lived third-party privilege as a governance defect rather than an exception queue.
• Bring machine accounts into continuous review Inventory service and machine accounts now, then monitor their ownership, access scope, and usage patterns continuously so AI-adjacent automation does not inherit unmanaged privilege.

Key takeaways

• The central problem is not a lack of identity controls, but a lack of continuous visibility into the identities that are already active across human, third-party, and machine contexts.
• The DBIR patterns discussed in the article connect credential abuse, shadow AI, and delayed third-party remediation into one governance failure: unseen identities remain actionable for attackers.
• Identity observability changes the programme response from periodic review to continuous discovery, correlation, and retirement across the full identity lifecycle.

Key terms

• Identity Observability: Identity observability is a continuous governance approach that correlates identity activity with business context, telemetry, and policy state. Instead of checking access at a single point in time, it tracks what an identity can do, what it did, and why that action matters to the business.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• Third-Party Identity: An identity issued to a partner, vendor, contractor, or external service that can access internal systems. These identities often sit outside normal employee governance and can become persistent trust paths if they are not reviewed, expired, and revoked on schedule.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.