Identity security is becoming the foundation of defense in depth

At a glance

What this is: Saviynt’s discussion argues that identity security has moved from a compliance function to a foundational layer of defense in depth as AI compresses exploit windows and non-human identities scale faster than traditional workforce controls.

Why it matters: It matters because IAM, NHI, and AI governance teams now have to treat identity as the enforcement layer that gives zero trust, detection, and privilege control something real to act on.

Context

Identity security is the set of controls that govern who and what can access systems, data, and resources. In this article, the central problem is not access administration itself, but the fact that identity has become the control layer that determines whether defence-in-depth actually holds when attackers move laterally or escalate privilege.

The article also ties that governance problem to two structural shifts: AI is compressing the time between vulnerability discovery and exploitation, and non-human identities now outnumber human identities in many environments. That combination changes identity from a workforce access concern into a broader security design issue that spans service accounts, bots, and AI agents.

For identity programmes, the message is that certification, conditional access, detection, and zero trust cannot be treated as separate workstreams. They depend on the same identity substrate, and when that substrate is weak or incomplete, the rest of the control stack becomes harder to enforce.

Key questions

Q: What breaks when identity security is not integrated into defence in depth?

A: Without identity security, zero trust has nothing to enforce, detection tools lose context, and attackers can move laterally using valid access paths. The breach pattern then becomes a control failure, not just a malware event. Identity is the layer that turns policy into enforcement, so weak governance there degrades the rest of the stack.

Q: Why do AI-accelerated exploits change identity security risk so quickly?

A: AI shortens the time between disclosure and a usable exploit, which means defenders lose the buffer they used to rely on for coordinated patching. In identity security, that compresses the safe operating window for any platform that still needs customer-side upgrade steps before remediation is complete.

Q: What do security teams get wrong about vendor certifications?

A: They often treat certification as proof that the vendor is safe in every context. In reality, a certificate is evidence of a control baseline at a point in time, not a guarantee that current access, recovery, and offboarding processes are still effective.

Q: How should organisations govern non-human identities alongside employee access?

A: Organisations should govern NHIs with the same discipline used for human access, but with stronger lifecycle ownership and expiry controls. That means inventorying service accounts, tokens, certificates, and agents, assigning business ownership, and tying every entitlement to a documented purpose. Governance is incomplete if machine access cannot be approved, certified, and removed on demand.

Technical breakdown

Why lateral movement succeeds when identity controls are incomplete

Lateral movement is the stage where an attacker expands from one foothold to other systems by abusing trust relationships, tokens, or excess entitlements. In most enterprises, the mechanics are simple: once an identity is compromised, the attacker looks for permissions that were never tightly scoped, never recertified, or never revoked. That is why identity sits at the centre of many breach paths. Endpoint telemetry and SIEM correlation can detect the behaviour, but they rarely stop it unless identity events are in the control loop. Practical implication: treat entitlements, not just endpoints, as the place where lateral movement is prevented or contained.

Practical implication: move identity signals into detection and response so entitlement abuse is visible before the attacker reaches adjacent systems.

How privilege escalation turns identity into a breach multiplier

Privilege escalation is the point where an attacker converts low-value access into higher-impact control by exploiting misconfiguration, excessive standing privilege, or weak governance. Identity controls fail here when access is approved once and then assumed to remain appropriate, even as roles, projects, and business conditions change. This is also why certification campaigns often miss the real problem if they only confirm that access exists, rather than whether it should exist at that level. Practical implication: privilege should be measured as an active risk state, not a static permission record.

Practical implication: target standing privilege, dormant entitlements, and overbroad access paths rather than only reviewing named accounts.

Why AI compresses the identity response window

AI changes the attack tempo by shortening the time between vulnerability discovery and exploitation, which reduces the time available for manual review, ticket-based approvals, and slow remediation cycles. That makes identity governance more time-sensitive, because controls that depend on periodic human intervention can lag behind the speed of compromise. The article’s point is not that AI creates a new identity model, but that it makes the old one too slow. Practical implication: identity enforcement has to operate at machine speed if defenders want to keep pace with AI-assisted adversaries.

Practical implication: prioritise near-real-time policy enforcement and rapid revocation paths over review cycles that assume slower attacker behaviour.

Threat narrative

Attacker objective: The attacker aims to turn one compromised identity into broad enterprise access by moving laterally and escalating privilege before defenders can intervene.

1. Entry begins when attackers gain an initial foothold and obtain identity material that can be used to move beyond the first system.
2. Credential access and privilege abuse follow when the attacker leverages overlooked identity controls, standing access, or excess entitlements.
3. Lateral movement occurs as the attacker uses trusted identity paths to expand reach across the environment.
4. Impact follows when privilege escalation and movement across systems expose the organisation to broader compromise.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity security has become the enforcement layer that makes defence in depth real. The article is right to frame identity as more than an access administration function, because every other control layer depends on it being correct. Zero trust, endpoint detection, and cloud policy all collapse if the identity layer cannot express and enforce who should have access. The practitioner implication is that identity governance now sits in the security architecture, not beside it.

Identity is where breach paths repeatedly converge. EY’s forensic lens reinforces a familiar pattern: attackers do not need to defeat every control if they can abuse the identity path that links systems together. Lateral movement and privilege escalation are not side effects of identity weakness, they are often the mechanism of compromise. The implication is that identity controls have to be measured by how well they interrupt attack progression, not by how complete the directory looks.

Speed, scale, and smarts is the right lens for modern identity governance. The article’s three design principles map cleanly to the way identity programmes now fail: they are too slow for current exploit tempo, too narrow for the growth of non-human identities, and too rigid for dynamic business conditions. That combination makes static certification and periodic review insufficient on their own. The practitioner implication is that identity governance has to become adaptive rather than calendar-driven.

Non-human identity growth changes the centre of gravity for IAM. When service accounts, API keys, bots, and AI agents outnumber humans, workforce-centric IAM no longer covers the majority of identity activity. This is where NHI governance becomes inseparable from the broader security model, because machine identities now carry real operational privilege. The implication is that identity programmes must govern both human and non-human actors as one control plane.

Certification that removes only 2 to 5 percent of entitlements is compliance, not security. The article’s own benchmark draws a useful line between paper activity and control effectiveness. A programme that barely changes the entitlement surface is not materially reducing attack exposure. The implication is that recertification should be judged by the amount of privilege removed, not by campaign completion alone.

What this signals

Identity has to be operationalised as a runtime control, not a compliance artefact. The article’s core message is that the same identity layer now governs detection, zero trust, and AI readiness. Programmes that still treat identity as a back-office function will find themselves unable to enforce policy fast enough when attacker tempo increases.

NHI and AI growth are pushing IAM beyond workforce assumptions. When the majority of meaningful access belongs to non-human actors, traditional joiner-mover-leaver thinking is no longer enough. Identity teams need to assume that machine identities are part of the main security estate, not a side inventory.

For practitioners

• Strengthen identity as a detection signal Feed identity events into endpoint detection and SIEM so lateral movement and privilege abuse can be correlated in time, not after the fact.
• Review standing privilege first Prioritise accounts and entitlements that remain permanently enabled, because those are the most likely paths for escalation and reuse across systems.
• Rework certification success criteria Measure access reviews by the percentage of entitlements removed, not by whether the campaign was completed on schedule.
• Extend governance beyond workforce IAM Inventory service accounts, API keys, bots, and AI agents as governed identities so identity policy reflects the actual population being used.

Key takeaways

• Identity controls are now central to defence in depth because they determine whether access policy can actually be enforced across systems.
• The article links breach paths to lateral movement, privilege escalation, and faster AI-assisted exploitation, which raises the value of real-time identity signals.
• Security teams should judge identity programmes by how much access they remove and govern, not by whether campaigns are merely completed.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Defense in depth: Defense in depth is the practice of stacking independent controls so one failed check does not expose the whole system. In App Router authentication, that means verifying identity in middleware, route handlers, and data access logic, because each layer protects a different part of the request path.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.