TL;DR: Identity security maturity is no longer just about getting human access right, because service accounts, bots, workflows, and AI agents now create continuous governance pressure across enterprise systems, according to SailPoint. The real test is whether identity programmes can automate visibility, policy enforcement, and lifecycle control across every identity type before fragmentation turns into risk.
At a glance
What this is: This blog argues that identity security maturity is being reset by the rise of non-human identities and AI agents, with automation becoming the defining measure of control.
Why it matters: IAM, IGA, PAM, and NHI teams need to treat maturity as a continuous control problem across every identity type, or governance will lag the environment it is meant to secure.
Context
Identity security maturity now depends on how well an organisation governs people, service accounts, bots, workflows, and AI agents together. The old model, where maturity largely meant getting human access right, no longer describes the control problem enterprises face.
The governance gap is not just scale. It is the combination of fragmented identity data, manual hand-offs, and inconsistent policy enforcement across environments, which makes it harder to see who or what has access and whether that access is still appropriate. This is an identity security and NHI governance problem, not only an automation discussion.
The article frames maturity as a moving target. That framing matters because the control baseline changes as fast as the identity estate expands, so the question for practitioners is whether their programme can adapt before complexity becomes operational risk.
Key questions
Q: How should security teams govern non-human identities at scale?
A: Security teams should treat non-human identities as a lifecycle problem with ownership, review, rotation, and revocation built in from the start. Inventory is necessary but insufficient. The control objective is to ensure every service account, token, or automation identity has a clear purpose, a bounded scope, and a reliable offboarding path when it is no longer needed.
Q: Why do fragmented identity systems increase breach risk?
A: Fragmentation hides who really has access, so dormant accounts, duplicate identities, and inconsistent permissions can survive long after business need changes. That makes audits incomplete and remediation slow. In practice, attackers benefit because hidden privilege is harder to detect than a clearly governed entitlement.
Q: What breaks when identity governance processes rely too heavily on manual reviews and assessments?
A: Manual governance breaks down when access volumes grow faster than review capacity. Teams miss toxic combinations, delayed deprovisioning, and inconsistent policy enforcement across systems. That creates audit findings, weak accountability, and higher risk of inappropriate access lingering after role changes, project completion, or application migrations.
Q: How do organisations decide when to prioritise automation over manual identity processes?
A: Organisations should prioritise automation when manual workflows are delaying joiner access, certifications, or offboarding at scale. The decision is strongest where task volume is high, the process is repetitive, and the business impact of delay is measurable. Automation is most valuable when it shortens cycle time and reduces avoidable human error.
Technical breakdown
Why identity maturity now depends on non-human identity governance
A mature identity programme can no longer be measured only by how well it handles employee access. Service accounts, bots, and automated workflows can continuously reach sensitive systems, often at machine speed and with far less visibility than human accounts. That changes the governance burden from periodic review to continuous control over creation, entitlement, and decommissioning. In practice, this means NHI lifecycle discipline becomes part of the maturity model itself, not a separate hygiene task. The maturity question is no longer whether identities are managed, but whether the programme can govern every identity type with equal rigour as the environment changes.
Practical implication: Treat NHI lifecycle oversight as a core maturity requirement, not an adjunct to human IAM.
How fragmentation and manual processes suppress maturity
Fragmented identity data means no single control plane can reliably show all identities and their entitlements. Manual processes then slow changes, create hand-off errors, and leave policy enforcement dependent on people remembering to act. Those gaps are especially damaging when non-human identities are created and retired rapidly, because the window between issuance and misuse can be short. Mature programmes reduce that delay by automating discovery, policy decisions, and deprovisioning across systems. The technical point is simple: if governance relies on human cadence while identities move at system cadence, maturity scores will lag reality.
Practical implication: Eliminate manual hand-offs where identity state changes faster than review cycles.
Why automation is now the maturity control, not just a support tool
Automation in this context is not about convenience. It is the mechanism that lets an identity programme scale visibility, risk scoring, monitoring, and policy enforcement across human and non-human identities without collapsing under volume. When thousands or millions of access changes occur, manual oversight cannot preserve consistency. Automation also makes enforcement more predictable across multiple environments, which is critical when policies differ across platforms. That is why the article treats automation as the key maturity lever: it converts identity security from an episodic governance activity into a continuous control system.
Practical implication: Automate provisioning, monitoring, and policy enforcement together so control quality does not depend on volume staying low.
Breaches seen in the wild
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity maturity is now a governance model for mixed human and machine populations. The old maturity story assumed the identity estate was mostly human and could be governed through access administration and periodic checks. That assumption no longer holds when service accounts, bots, workflows, and AI agents are continuously active in production systems. The implication is that maturity must be measured by whether governance spans every identity type with equal control depth.
Fragmented identity visibility is the maturity failure mode, not just an operational inconvenience. When identity data sits in silos, teams cannot reliably answer who has access, what kind of identity it is, or whether the entitlement still matches the task. That creates policy drift, inconsistent enforcement, and delayed response. The practitioner conclusion is that visibility quality is now a maturity signal in its own right.
Automation has become the control plane for identity security maturity. Manual reviews and hand-offs were tolerable when identity changes were slower and more bounded. They are inadequate when non-human identities are created, modified, and retired at machine speed across multiple systems. The implication is that maturity scoring should increasingly reflect how much of the identity lifecycle is governed programmatically.
Continuous improvement is now part of the identity control architecture. The article is right to frame maturity as a moving target, because static governance models decay as soon as new identity classes appear. Organisations that keep revising controls, policy boundaries, and monitoring thresholds will outpace those that freeze their programme around yesterday's access model. The practitioner conclusion is to treat maturity assessments as an operating rhythm, not a one-time benchmark.
What this signals
Identity maturity is increasingly defined by lifecycle speed, not access administration completeness. If service accounts, workflows, and AI agents can be created and retired faster than governance cycles, the programme will always appear a step behind. Practitioners should watch for places where policy enforcement depends on a person noticing a change rather than a system enforcing it.
Continuous governance is becoming the real benchmark for NHI and agentic AI readiness. That means identity teams need controls that operate at machine cadence, across environments, and across identity types, or maturity will remain fragmented even if human IAM looks strong.
For practitioners
- Map all identity classes Build an inventory that separates human users, service accounts, bots, workflows, and AI agents so governance gaps are visible by identity type, not hidden in aggregate access reports.
- Automate lifecycle control points Automate provisioning, deprovisioning, monitoring, and risk scoring together so non-human identities do not rely on manual hand-offs or delayed review cycles.
- Replace siloed entitlement views Create a single governance view that correlates identities, entitlements, and policy state across environments to reduce fragmentation and inconsistent enforcement.
- Rebase maturity assessments Score the programme on its ability to keep pace with rapid identity creation, change, and removal, rather than on whether traditional human access controls are in place.
Key takeaways
- Identity security maturity now depends on whether governance spans people, service accounts, bots, workflows, and AI agents as one control problem.
- Fragmented identity data and manual hand-offs are the main reasons maturity programmes fall behind the environment they are supposed to govern.
- Automation is the practical threshold that separates a static identity programme from one that can keep pace with rapid identity change.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on governing expanding non-human access across sensitive systems. |
| NHI-01 — Improper Offboarding | Rapid decommissioning is one of the maturity challenges called out for non-human identities. | |
| Recommendation — Audit NHI entitlements and reduce standing access where identity sprawl exceeds governance capacity. Automate offboarding for service accounts, bots, and workflows so stale access does not outlive the task. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing entitlements across mixed identity populations. |
| Recommendation — Centralise entitlement governance so access permissions stay consistent across human and non-human identities. | ||
| CIS Controls v8 | CIS-5 — Account Management | The maturity gap is driven by identity sprawl, manual processes, and inconsistent account handling. |
| Recommendation — Use account management controls to inventory, monitor, and deprovision all identity types on a continuous basis. | ||
| MITRE ATT&CK | TA0003;TA0004 — Persistence; Privilege Escalation | The article warns that governance gaps create exploitable conditions for adversaries. |
| Recommendation — Map unmanaged identity lifecycle gaps to persistence and privilege escalation risks in your detection model. | ||
Key terms
- Identity Security Program Maturity: Identity security program maturity describes how well an organisation can govern, monitor, and improve identity controls over time. Mature programmes have clearer ownership, repeatable processes, better visibility, and stronger response capability across human and non-human identities, rather than relying on isolated tools or ad hoc fixes.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Identity Fragmentation: Identity fragmentation is the condition where different parts of an infrastructure estate use separate trust models, credentials, and policy systems. In hybrid environments, this breaks unified governance because access, logging, and revocation no longer line up across cloud, data center, and colocated resources.
- Lifecycle Automation: The automation of identity events such as onboarding, access changes, and revocation so governance follows the full user or account lifecycle. It reduces manual errors, shortens exposure windows, and helps organisations enforce consistent access controls at scale.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org