TL;DR: Credential compromise remains a leading breach path and only one in five organisations fully achieves IAM goals, according to Gartner research cited by CyberArk. That makes identity security a strategic control plane for zero trust, not an operational afterthought, because human, AI, and machine identities now define the enterprise perimeter.
At a glance
What this is: CyberArk argues that identity security is becoming the control plane for zero trust, because credential compromise, fragmented IAM execution, and expanding human, AI, and machine identity estates now define enterprise risk.
Why it matters: For IAM and security leaders, this matters because identity is no longer just an access administration function, it is the point where governance, resilience, and continuous trust either hold or fail across NHI, autonomous, and human identity programmes.
Context
The core problem is not the absence of identity controls, but the fact that many organisations still treat IAM as a back-office function while their threat model has already shifted to identity-centric access. In a zero trust architecture, identity is the decision layer that determines whether users, workloads, AI systems, and services should be trusted at all.
CyberArk's article argues that the perimeter has effectively moved into identity itself. That means the control plane question is no longer whether access exists, but whether access can be continuously verified, measured, and reduced across the full identity estate.
For CISOs, the governance gap is that strategy, risk, and access operations are still often managed separately. The article's central claim is that this split no longer matches how modern environments actually work, where trust, privilege, and business agility now depend on the same identity fabric.
Key questions
Q: When should zero trust be applied in an IAM programme?
A: Zero trust should be applied at sensitive access boundaries, not only at the network edge. Re-check identity before privileged actions, high-value data access, and recovery paths that can reset trust. This reduces blast radius when credentials are stolen or a session is being abused.
Q: Why do compromised credentials remain so effective in modern environments?
A: Compromised credentials remain effective because they produce legitimate-looking access. Many environments still trust the identity after the password, token, or session is accepted, even if the login originated from a risky device or abnormal context. That makes identity confidence a live security issue, especially when access is broad or long-lived.
Q: What are the signs that an IAM programme is not working as a control plane?
A: Long deprovisioning delays, weak MFA coverage, poor privileged access measurement, and fragmented identity ownership are strong signals. If identity controls cannot be measured against business outcomes and response speed, they are functioning as admin tasks rather than strategic controls.
Q: How should security teams implement AI in identity-heavy environments?
A: Start with a narrow use case tied to a measurable security outcome, such as faster alert triage or fewer false positives. Keep the workflow bounded by policy, require human approval for identity changes, and review whether the AI improves the control it was meant to support. If the result cannot be measured, it should not be scaled.
Technical breakdown
Identity-first security as the trust decision layer
Identity-first security shifts trust decisions from network location or device posture to the identity that is requesting access. In practice, that means every session, workload call, and privileged action is evaluated against identity context, not just a static permission set. The control plane role matters because zero trust depends on continuous verification, not one-time approval. When identities span people, services, and AI-driven workflows, the trust decision must be able to follow the subject across environments and usage patterns without assuming a fixed perimeter.
Practical implication: build policies that evaluate identity context continuously instead of relying on inherited trust from network or application placement.
Why IAM maturity becomes a strategic risk signal
IAM maturity is not just an implementation detail. It is a measure of whether the organisation can reduce loss, preserve agility, and keep privileged access understandable at scale. The article points to benchmarking IAM gaps, measuring deprovisioning time, privileged access transactions, and MFA coverage as evidence that the programme is being governed as strategy rather than admin work. That matters because identity controls only produce security value when they are tied to business outcomes and operational reporting, not when they sit as isolated tools.
Practical implication: measure IAM as a risk and agility programme, not just by ticket volume or directory administration throughput.
How ITDR changes identity defence
Identity threat detection and response extends monitoring into credential misuse, privilege abuse, and suspicious access paths. Unlike perimeter alerting, ITDR focuses on the behaviour of identities after authentication and during privilege use. That becomes essential when credential compromise remains a leading breach vector, because the security question is no longer only who authenticated, but whether their identity has been abused in-session or through delegated access. In a mature model, detection and response are tied directly to identity telemetry and entitlement change events.
Practical implication: correlate authentication, entitlement, and privilege-use signals so identity abuse can be detected before it becomes lateral movement or data loss.
Threat narrative
Attacker objective: The objective is to turn legitimate identity trust into sustained access that enables privilege abuse, data exposure, or disruption without triggering traditional perimeter defences.
- Entry begins when attackers obtain valid credentials or abuse identity trust rather than exploiting the network perimeter directly. In identity-centred environments, authentication is often the first foothold.
- Escalation follows when privileged access, overbroad entitlements, or stale identities let the attacker move from ordinary access to higher-value systems and actions.
- Impact occurs when the compromised identity is used to bypass zero trust assumptions, access sensitive assets, or undermine the organisation's ability to trust its access controls.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity security is now the control plane, not a supporting control. Once enterprises span users, workloads, bots, and AI agents, identity becomes the layer that decides trust before access is granted. That is not a tooling preference, it is a governance reality. CISOs who still position IAM as an administrative function are managing yesterday's control model, not today's access risk.
Credential compromise exposes the failure of perimeter-era assumptions. The article's cited breach pattern shows that attackers do not need to defeat the environment if they can inherit trust through identity. That makes identity the real perimeter in zero trust architectures. Practitioners should read this as a structural shift in where compromise happens, not just how it is detected.
Documented IAM strategy is a governance requirement, not a maturity exercise. The article links written IAM strategy to better business agility and reduced loss, which means IAM cannot remain a collection of local decisions. Strategy, measurement, and accountability have to be aligned or the programme stays reactive. The implication is that identity governance must be planned as a board-relevant control plane.
Continuous trust depends on integrating privileged access, secrets, and adaptive authentication. The article's strongest signal is that identity control works only when the governance model covers the whole path from authentication to privilege use. That aligns with a broader identity fabric approach across human and non-human access. Practitioners should treat disconnected identity tools as a control fragmentation problem, not a coverage problem.
The named concept here is identity control plane fragmentation. This is the condition where IAM, PAM, secrets management, and identity threat detection are handled as separate programmes even though attackers experience them as one trust surface. The consequence is inconsistent verification and weak accountability across human, machine, and AI identities. Organisations need one governance model for identity trust, not separate operational silos.
What this signals
Identity control plane fragmentation: the more an organisation separates IAM, PAM, secrets management, and identity detection, the more inconsistent its trust decisions become. That fragmentation matters because modern access risk is not confined to one identity type. A single governance model is required if human and non-human identities are to be assessed consistently.
The practical shift for teams is from access administration to identity governance measurement. If deprovisioning speed, privileged access transactions, and MFA coverage are not being tracked together, the programme cannot prove whether it is reducing risk or just processing requests faster.
For practitioners
- Align IAM to cybersecurity strategy Tie IAM priorities to enterprise risk, resilience, and digital transformation objectives rather than treating access administration as a standalone service.
- Benchmark IAM maturity and gaps Assess where deprovisioning, privileged access, MFA coverage, and identity governance are lagging so planning is based on measurable control gaps.
- Instrument ITDR for identity abuse Correlate authentication events, privilege transactions, and entitlement changes so suspicious identity behaviour can be investigated quickly.
- Unify PAM, secrets, and adaptive authentication Consolidate the identity fabric so privileged access, secret handling, and step-up controls work as one governance path instead of disconnected processes.
- Document the IAM strategy Produce a written strategy that defines ownership, measurement, and prioritisation for identity controls across human and non-human estates.
Key takeaways
- Identity security is being positioned as the control plane for zero trust because trust decisions now live in the identity layer.
- Credential compromise remains a leading breach path, which makes identity governance central to resilience rather than merely operational hygiene.
- Teams need measurable IAM strategy, continuous trust controls, and integrated privileged access governance if they want identity to function as a strategic control plane.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The article frames IAM as a strategic risk and resilience control. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity-first security depends on governing access permissions continuously. | |
| DE.CM-01 — Networks and Systems Monitoring | ITDR relies on continuous monitoring of identity behaviour and access events. | |
| Recommendation — Align IAM priorities to enterprise risk and business agility objectives. Review and govern identity entitlements as part of the access control plane. Correlate identity telemetry with access events to detect misuse early. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article's focus on identity-controlled access maps directly to least privilege. |
| IA-5 — Authenticator Management | Credential compromise and MFA coverage make authenticator lifecycle central here. | |
| Recommendation — Enforce least privilege across human, workload, and privileged identities. Manage authenticators with rotation, revocation, and coverage controls. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Machine and workload identities are part of the control plane argument. |
| NHI-07 — Long-Lived Secrets | The article's credential compromise theme maps to persistent secret exposure. | |
| Recommendation — Reduce excessive non-human privilege before it expands attack paths. Replace long-lived secrets with short-lived, governed credentials. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Credential abuse is the breach path the article says defenders must plan around. |
| Recommendation — Map identity compromise to credential access and lateral movement tactics. | ||
Key terms
- Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
- Identity-first security: Identity-first security is an approach that treats identity as the primary control plane for managing risk. Instead of relying mainly on network or endpoint boundaries, it uses identity context to decide what can happen, when it can happen, and under what conditions. That model is especially relevant where privileges move across human, non-human, and agentic actors.
- Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
- Identity Fabric: An identity fabric is a connected control model that shares context across governance, privileged access, and access management. It is not a product category. The aim is to make identity decisions coherent across the full lifecycle so ownership, privilege, and enforcement reinforce each other.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 30, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org