Identity security is becoming the control plane for business risk

At a glance

What this is: This conversation with PwC argues that identity security has become a strategic control plane because modern attacks now concentrate on identities, partners, and privileged access rather than networks alone.

Why it matters: For IAM, IGA, and PAM teams, the message is that identity governance is no longer just about access hygiene, but about enabling transformation while constraining business risk.

Context

The security gap is no longer at the network edge alone. Attackers increasingly target identities because they provide direct paths into business systems, partner relationships, and privileged workflows.

That shift changes identity security from a back-office control to a business operating layer. For IAM programmes, the practical question is whether governance, privileged access, and access management are connected well enough to support change without widening exposure.

Third-party access makes the problem harder because vendor and partner identities often sit outside the strongest internal controls. If those identities are not governed with the same discipline as employee access, the organisation leaves a durable entry point for attackers.

Key questions

Q: How should security teams govern identity as a control plane?

A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate. That means combining IAM, PAM, and NHI lifecycle controls with continuous evaluation, machine-readable policy, and delegation tracking. If identity is only provisioned and not governed, the rest of the stack is protecting decisions that were never validated.

Q: Why do third-party accounts increase identity risk?

A: Third-party accounts increase risk because they often reach sensitive systems without the same day-to-day scrutiny as internal users. If authentication is weak, permissions are broad, or offboarding is incomplete, a vendor identity becomes a durable entry point for attackers and a persistent compliance exposure.

Q: Where do identity programmes fail when business velocity increases?

A: They fail when access reviews and privilege controls are too detached from real business change. Fast-moving transformation creates more exceptions, more partner access, and more elevated activity, so static review cycles and siloed tooling cannot keep pace with the actual risk.

Q: What does integrated identity security change for PAM and IGA teams?

A: It forces PAM and IGA teams to measure the same thing from different angles: who can reach what, why that access exists, and how quickly it can be removed. The practical shift is from isolated controls to coordinated governance over privileged reach and entitlement sprawl.

Technical breakdown

Why identity has become the primary entry point

Identity is now the most efficient route for an attacker because it bypasses perimeter assumptions and lands directly in business applications and sensitive workflows. When access is granted through accounts, tokens, or privileged pathways, the attacker does not need to defeat the infrastructure layer first. That means identity control is no longer a supporting function behind security architecture. It is the place where access decisions, risk signals, and business continuity converge.

Practical implication: Treat identity as the first control plane to inspect when reviewing breach paths, not the last.

How integrated governance, PAM, and access management change the model

Governance, privileged access management, and access management solve different parts of the same problem. Governance defines who should have access and why. PAM governs high-risk elevation and session control. Access management handles authentication and routine access decisions. The article’s point is that these layers must work together because identity-based attacks exploit the gaps between them, not just failures inside one product category.

Practical implication: Map your current identity stack for handoff gaps between provisioning, elevation, and review.

Why third-party identity risk now matters more

Partner and vendor accounts often carry legitimate access into core business systems, which makes them attractive to attackers. If third-party identities are not inventoried, scoped, and continuously governed, they become durable pathways into the enterprise. The risk is not simply that a partner account exists. The risk is that its lifecycle, access scope, and oversight may be weaker than those applied to employees.

Practical implication: Extend governance coverage to external identities with the same rigor used for internal privileged users.

Threat narrative

Attacker objective: The objective is to turn trusted identity access into broad business reach without triggering immediate detection.

1. Entry begins with identity compromise or abuse rather than network intrusion, giving the attacker an authentic access path into business systems.
2. Escalation occurs when privileged access or poorly governed third-party permissions allow the attacker to move beyond the initial account scope.
3. Impact follows as the attacker uses legitimate-looking access to roam across systems, disrupt operations, or expose sensitive business data.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity security has become the control plane for business risk, not just a control layer for IT risk. When attackers target identities, they are targeting the mechanism that links users, partners, privileges, and business systems. That makes governance, privilege control, and access management part of operational resilience rather than hygiene. The implication is that identity programmes now need to be judged on business continuity impact, not only on compliance coverage.

Third-party access is the most underappreciated risk multiplier in identity governance. Vendor and partner identities often arrive with legitimate business justification but uneven lifecycle control. If those accounts are not governed with the same review, scoping, and offboarding discipline as internal access, they create an entry path that is both trusted and persistent. Practitioners should treat external identity sprawl as a core attack surface.

Integrated identity security is becoming the practical definition of Zero Trust for the business layer. Authentication alone does not stop an attacker who already holds valid access. The control value comes from combining access governance, elevation controls, and continuous decisioning around who should be able to do what. That shifts the programme from perimeter defence to business transaction assurance.

Identity security now sits inside transformation strategy because agility without governed access simply accelerates risk. CEOs may want faster reinvention, but identity is what determines whether that reinvention is safe to execute. A programme that cannot govern privileged and third-party access will slow transformation later through incidents, exceptions, and audit friction. The practical conclusion is that identity capability is a business enabler only when it can absorb change without losing control.

Identity blast radius is the right concept for this moment. Once an identity is compromised, the damage depends on how far that identity can reach across systems, partners, and privileged actions. That means the governance question is not only who has access, but how much business blast radius each identity creates. Practitioners should measure and reduce that blast radius continuously.

What this signals

Identity security is becoming the business layer’s operating control. As organisations modernise, identity becomes the enforcement point for who can reach critical systems, which makes it central to resilience and transformation planning. IAM leaders should assume that future business change will be judged by whether identity governance can keep pace.

Third-party access is where many programmes will discover their weakest governance assumptions. External identities often sit outside the routines built for employees, yet they can carry equal or greater access into core environments. The programme question is no longer whether partners need access, but whether their entire lifecycle is governed with the same discipline as internal access.

For practitioners

• Map identity control handoffs Identify where governance, PAM, and access management are disconnected in provisioning, elevation, review, and revocation workflows.
• Inventory third-party identities Create a complete inventory of partner and vendor accounts, then classify them by business system reach, privilege level, and renewal owner.
• Tighten privileged access pathways Review every route that allows elevated access into critical systems, especially where standing privilege or unmanaged exceptions persist.
• Align identity metrics to business risk Track identity coverage, privileged access exposure, and offboarding latency as indicators of business resilience, not just IAM completeness.

Key takeaways

• Identity security is no longer just an access-control function because attackers now target identities, privileged paths, and partner accounts as the shortest route into business systems.
• The article ties that shift to business urgency by citing PwC’s CEO survey, where over half of CEOs fear their current business model will not be viable in the next decade without transformation.
• The practical response is integrated governance across PAM, access management, and identity governance so that transformation speed does not outpace control.

Key terms

• Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
• Third-party identity exposure: Third-party identity exposure is the risk that external suppliers, contractors, partners, or their systems can access an organization through identities that are not directly controlled by the organization. It includes shared accounts, delegated access, tokens, and integrations. The exposure increases when identity lifecycle, privilege, and monitoring are weak.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Integrated identity security: A governance model that connects access management, privileged access management, and identity governance into one operating approach. It matters because identity-based attacks exploit gaps between those functions more often than failures inside a single control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.