Identity security is now the control plane for human and machine access

At a glance

What this is: This is an analysis of why identity security, not basic IAM, is becoming the control plane for human and machine access as usage visibility and lifecycle governance matter more than permission records alone.

Why it matters: It matters because IAM, IGA, PAM and NHI programmes now need evidence of actual access use, not just entitlement state, to reduce dormant privilege, machine identity risk and audit exposure.

By the numbers:

• 88% of web application breaches now involve stolen credentials.
• Over 95% of enterprise permissions go unused.

Context

Identity security is the discipline of governing what identities can do and what they actually do across an environment. In this article’s framing, traditional IAM stops at authentication and entitlement assignment, which leaves a governance gap once access is granted.

That gap matters because human users, contractors, service accounts, bots and AI agents are now part of the same access fabric. When identity data is fragmented across directories, cloud platforms, SaaS applications and HR systems, security teams can see permissions but still miss usage, dormancy and unusual activity.

The result is a control model that is structurally weaker than the environment it is meant to govern. The article argues that usage-aware visibility and lifecycle enforcement are now required to make identity controls operational rather than documentary.

Key questions

Q: What breaks when identity programmes only track permissions and not actual usage?

A: They miss dormant access, active abuse and stale entitlements that still look valid on paper. Permission-only programmes can certify accounts without knowing whether the access is being used, making reviews slow, noisy and weak at reducing risk. Usage data is what converts identity governance from an inventory exercise into a control function.

Q: Why do unused permissions increase identity risk so much?

A: Because unused access is still real access, and attackers look for accounts that already have privileges they do not need. Dormant entitlements expand the blast radius of credential theft, contractor drift and machine-account abuse. The more unused access you carry, the more paths an attacker can exploit after sign-in.

Q: Why do service accounts and AI agents need different controls from human users?

A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.

Q: How do security teams know whether identity governance is reducing risk?

A: Look for shorter time from access change to visibility, fewer unmanaged entitlements, and faster completion of review and remediation cycles. If access risk remains unchanged after deployment, the programme may be reporting activity without changing control outcomes.

Technical breakdown

Why permission data is not the same as access reality

Traditional IAM records what was provisioned, not what is actively exercised. That distinction matters because entitlement lists quickly become stale when accounts move, projects end, or machine identities continue operating after their original purpose changes. Identity security closes that gap by correlating directory data, cloud activity, SaaS events and HR context into one access picture. The technical shift is from static authorisation state to observed identity behaviour. That is what lets teams distinguish dormant access from active exposure and understand whether a permission is merely present or actually exploitable.

Practical implication: treat entitlement inventories as incomplete until they are joined to observed usage and lifecycle state.

Why non-human identities change the control model

Service accounts, API keys, bots and AI agents are not governed well by human-centric certification cycles because they often authenticate differently, run continuously and rarely trigger user-style behaviour patterns. Their privileges can be elevated, persistent and difficult to attribute to a business owner. In practice, that means the control question is no longer only who may sign in, but which machine identities exist, what they can reach, how their access is monitored and when their access is removed. For NHI programmes, inventory and lifecycle are inseparable from governance.

Practical implication: extend identity governance to machine identities with the same ownership, visibility and offboarding discipline used for human accounts.

Usage-aware governance is the missing layer between IAM and IGA

IAM provisions access and IGA certifies it, but neither layer is sufficient if the organisation cannot see what happens after authentication. Usage-aware governance adds behavioural context such as last login, dormant privilege, unusual access time and resource-level activity. That is the difference between a policy that exists on paper and a control that can actually reduce risk. The operational model becomes continuous rather than quarterly, with monitoring and response tied to what identities do in real time. That is the control plane the article is describing.

Practical implication: move review and detection workflows toward continuous usage evidence instead of relying only on periodic certifications.

Threat narrative

Attacker objective: The attacker wants to turn valid but under-governed identity access into undetected reach across sensitive resources.

1. Entry occurs through stolen credentials rather than perimeter bypass, which shifts the attack surface to authenticated access.
2. Escalation happens when dormant permissions or elevated entitlements are available to the compromised identity.
3. Impact follows when the attacker moves through cloud, SaaS or data resources under legitimate access paths, often before the organisation notices the behaviour change.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity security is now the control plane because permission state no longer explains risk. IAM can tell you who was granted access, but it cannot tell you whether that access is dormant, misused or silently expanding. That breaks the old assumption that provisioning data and security state are close enough for governance. The practical consequence is that identity programmes must be judged by what they can observe and revoke, not what they can list.

Usage-aware governance is the named capability the article is really pointing to. The useful distinction is not IAM versus IGA, but static entitlement management versus continuously observed identity behaviour. That is the control gap that allows unused privilege, stale contractor access and abnormal machine activity to persist. Security teams should treat usage visibility as the operational layer that makes lifecycle and certification meaningful.

Non-human identities now force identity governance to operate across human and machine estates at the same time. Service accounts, API keys, bots and AI agents do not fit neatly into human review cadences, yet they now sit inside the same attack surface. The programme implication is that identity governance can no longer assume a human owner, a human login rhythm or a human offboarding event. Teams need one governance model that spans both workforce and machine access.

Permission-only programmes are becoming audit liabilities, not just security blind spots. When regulators and cyber insurers expect demonstrable monitoring, a policy stack that cannot show actual usage leaves weak evidence even if it is technically compliant on paper. That shifts the identity function from administrative hygiene to control evidence generation. The practical conclusion is that access governance must produce observable proof of risk reduction.

Identity blast radius becomes the more useful concept than identity count. The article’s central lesson is not that there are more identities, but that fragmented identity data and unused privileges expand the damage any one compromised account can cause. The more valuable question for practitioners is where excessive access is concentrated and how quickly it can be invalidated. Governance should focus on limiting blast radius, not just cataloguing identities.

What this signals

Usage-aware governance is the practical shift that separates identity security from traditional IAM. For practitioners, the issue is not whether access exists but whether access is still justified and active. Programmes that cannot tie identity state to observed behaviour will keep producing clean reports while leaving real exposure untouched.

Non-human identity coverage has become a programme boundary test. If service accounts, API keys, bots and AI agents are outside the same governance workflow as human accounts, the control model is incomplete. That gap matters most where machine identities hold elevated privileges or outlive the business process that created them.

For practitioners

• Unify identity data across systems Aggregate identity, entitlement and activity data from IdPs, cloud platforms, SaaS applications and HR systems into one view so you can compare provisioned access with observed use.
• Measure real access usage Track last login, dormant accounts, never-used privileges and unusual access patterns so reviews are based on evidence instead of static permission lists.
• Extend governance to machine identities Inventory service accounts, API keys, bots and AI agents, then assign owners, usage monitoring and offboarding rules that match their operating model.
• Turn access reviews into risk decisions Use contextual evidence such as unused access, separation-of-duties conflicts and abnormal timing to make certifications actionable rather than ceremonial.
• Build continuous remediation around identity signals Trigger revocation, escalation or investigation from active identity behaviour instead of waiting for quarterly review cycles to catch the problem.

Key takeaways

• Identity security is replacing permission-only IAM because security teams need to know how access is being used, not just who was granted it.
• Fragmented identity data and unused privileges create the blind spots that make dormant accounts, contractor drift and machine identity abuse hard to detect.
• The control shift is toward continuous usage evidence, machine identity governance and faster revocation when access no longer matches business need.

Key terms

• Identity Security: Identity security is the discipline of governing who and what can access systems, data, and tools, then proving those decisions are enforced. In practice it spans human users, service accounts, tokens, certificates, and AI agents across the full access lifecycle.
• Usage-aware governance: A governance model that uses actual activity as part of access decisions. Instead of certifying access only by role or schedule, it checks whether the entitlement is still being used, still justified, and still appropriate for the current context.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.