Identity security maturity is still missing the security problem

At a glance

What this is: This report argues that many identity security programmes still optimise for compliance evidence rather than continuous risk reduction, even though breaches continue despite common controls being deployed.

Why it matters: It matters because IAM, IGA, and PAM teams need to judge whether their controls reduce exposure across human, NHI, and autonomous identity use cases, not just satisfy review cycles.

By the numbers:

• 71% of organizations experienced a security breach last year, according to Clarity Security.
• Non-human identities now outnumber human identities by 144 to 1 and that ratio is growing by 44% annually, according to Clarity Security.

👉 Read Clarity Security's report on the three stages of identity security maturity

Context

Identity security maturity is the way an organisation progresses from basic access control to a programme that can actually reduce exposure across users, accounts, tokens, and automated identities. This report argues that many programmes are still judged by whether they can document access, not whether they can contain risk.

Clarity Security frames the current market as moving through three stages: Inherent Trust, Conditional Trust, and Adaptive Trust. That framing matters because it explains why a stack that looks mature on paper can still fail against cloud, SaaS, federated access, and non-human identity sprawl.

The article's central claim is that most organisations are operating in the middle stage, where governance is strong enough for audit evidence but not yet strong enough for continuous security outcomes. That is typical for modern identity programmes, which were built for control assurance first and risk reduction second.

Key questions

Q: What breaks when identity programmes are built mainly for compliance evidence?

A: They become good at proving that access was reviewed, provisioned, and deprovisioned on schedule, but weak at reducing live exposure. Attackers exploit the gap between a documented process and the actual time credentials remain usable. The control plane looks mature while the security outcome stays flat.

Q: Why do mature IAM controls still leave organisations exposed?

A: Because SSO, MFA, and access reviews solve governance and authentication problems, but they do not automatically limit how long valid access can remain risky. If the model is still optimized for auditability, the organisation can pass reviews while attackers move through approved access paths.

Q: What are the signs that an identity programme is stuck in Conditional Trust?

A: Look for strong provisioning workflows, scheduled access recertifications, and a heavy emphasis on audit trails, but little evidence that exposure is reduced between review cycles. If the programme measures process completion more than residual risk, it is still operating in Conditional Trust.

Q: How should teams respond when non-human identities outgrow their intended scope?

A: Revalidate ownership, scope, and offboarding status for service accounts, workloads, and AI agents before adding more access. When machine identities scale faster than governance, the correct response is to shrink persistence and narrow reach, not simply to monitor a larger estate more closely.

Technical breakdown

Why perimeter trust collapsed in modern identity environments

The earliest identity controls assumed a stable boundary between trusted and untrusted users, applications, and networks. That model worked when workloads stayed on premises and access paths were tightly bounded. Cloud infrastructure, remote work, and SaaS broke that assumption by decoupling identity from location, so a network boundary no longer tells you whether access is legitimate or risky. The technical issue is not that perimeters were never useful, but that they no longer describe the real access surface. Practical implication: identity programmes must evaluate access based on entitlement, context, and lifecycle, not network placement.

Practical implication: shift control design away from location-based trust and toward entitlement and lifecycle signals.

How compliance-first IGA leaves risk visible only at review time

Identity governance and administration platforms were built to prove that access was provisioned, reviewed, and removed according to process. That is a governance model, not a runtime security model. When access reviews happen on a schedule, the programme can only detect drift after it has already existed for some period. The article's key point is that this creates a gap between documentation and defence, especially when credentials are valid and actively usable between review cycles. Practical implication: treat review outputs as evidence of governance state, not as proof that risk has been reduced.

Practical implication: do not confuse audit-ready review artefacts with controls that meaningfully contain live exposure.

Why non-human identities expose the limits of human-centric lifecycle controls

Human identity lifecycle management assumes a person joins, changes role, and eventually leaves on a track that can be governed with provisioning and deprovisioning. Non-human identities behave differently: service accounts, API keys, OAuth tokens, and AI agents can be created automatically, reused across systems, and left active without a clean owner. That makes human-oriented lifecycle logic too slow and too shallow for machine credentials. The article uses the 144 to 1 ratio to show how much of the modern access surface sits outside classic human identity governance. Practical implication: inventory, ownership, and retirement controls for NHIs need their own operating model.

Practical implication: govern NHI lifecycle as a distinct control plane, not as a by-product of workforce IAM.

Threat narrative

Attacker objective: Exploit valid, already-governed access paths before the organisation's review cycle can surface and remediate the risk.

1. Entry occurs through valid access that already exists, because the article describes breaches happening despite deployed SSO, MFA, and access reviews.
2. Credential or access abuse follows when attackers operate inside a trust model that was designed to document access rather than neutralise live risk.
3. Impact emerges when the programme cannot close exposure in real time, so valid credentials remain useful even while the breach is underway.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Compliance assurance is not the same as security control: The identity category was shaped to prove that access was managed according to process, not to close risk in motion. That design choice made sense under Sarbanes-Oxley pressure, but it now leaves modern programmes optimised for auditability instead of defence. Practitioners should stop treating review completion as evidence of reduced exposure.

Conditional Trust is the dominant failure mode in mature IAM programmes: Most organisations have moved beyond perimeter thinking, but they have not moved far enough to change the core operating model. Conditional Trust governs joiner-mover-leaver workflows well, yet it leaves federated access, nested entitlements, and continuously valid credentials outside meaningful containment. The practitioner conclusion is that maturity claims must be tested against how fast risk actually changes.

Identity security maturity needs a named third stage because the current model is structurally incomplete: Adaptive Trust is the article's most useful concept because it shifts the question from whether access was recorded to whether exposure is being reduced continuously. That is a category-level correction, not a feature request. Teams should use the three-stage model to identify whether their programme can respond to live risk or only report on it.

NHI growth makes the gap unavoidable: Non-human identities now sit outside the assumptions that shaped workforce IAM and classic IGA. Service accounts, tokens, and agents can appear and persist without the lifecycle cues that human governance depends on, so the old operating model no longer covers the real access estate. The practical conclusion is that identity maturity must expand to include machine and autonomous identities as first-class subjects.

Access review dependence: Access review processes were designed for access that remains stable long enough to be observed, certified, and remediated. That assumption weakens when access is continuously reused, federated, or machine-created, because the security outcome depends on issuance and revocation speed rather than periodic attestation. Practitioners should rethink review-centric maturity scoring as a signal of governance completeness, not risk containment.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Adaptive Trust is the useful target state: Identity programmes need to be judged by whether they can shorten the window between entitlement creation, risk detection, and revocation. A schedule-based review process cannot do that on its own, which is why maturity models that stop at compliance evidence miss the operational problem.

Conditional Trust remains the default for many programmes because it solves the auditor's question before it solves the attacker's question. The next step for practitioners is to map where their access estate is still governed by periodic review instead of by continuous exposure reduction.

For practitioners

• Reclassify access reviews as governance evidence Use review completion to prove oversight, but do not treat it as proof that live access risk has been reduced. Measure how long dangerous access can remain usable between review cycles.
• Separate human and non-human identity operating models Inventory service accounts, API keys, OAuth tokens, and AI agents as a distinct estate with explicit ownership, retirement, and exception handling. Do not fold them into workforce identity workflows.
• Test for continuously valid access paths Look for federated identities, nested group memberships, and role changes that increase access without a matching automatic reduction. Those are the places where Conditional Trust usually overstates control coverage.
• Define an Adaptive Trust target state Set programme goals around reducing the time between entitlement creation, risk recognition, and entitlement removal. The target is continuous exposure reduction, not better audit narrative.

Key takeaways

• The report's central warning is that identity maturity can look strong while breach exposure remains unchanged because the programme is built around proof, not prevention.
• The article cites 71% of organizations experiencing a breach last year even though most had SSO, MFA, and regular access reviews in place.
• Practitioners should measure identity maturity by how quickly they can reduce live access risk across human and non-human identities, not by how complete the review cycle appears.

Key terms

• Conditional Trust: An identity model where access is granted and reviewed through scheduled governance processes after trust has already been established. It is useful for compliance, but it can leave gaps when attackers move faster than review cycles or when machine identities do not fit human lifecycle assumptions.
• Continuous Adaptive Trust: Continuous adaptive trust is a runtime access model that adjusts permissions as an agent behaves. Access is time-bound, purpose-bound, and context-aware, then reduced or revoked when actions drift from expected intent. It is a stronger fit for agents than static entitlements alone.
• Identity Security Program Maturity: Identity security program maturity describes how well an organisation can govern, monitor, and improve identity controls over time. Mature programmes have clearer ownership, repeatable processes, better visibility, and stronger response capability across human and non-human identities, rather than relying on isolated tools or ad hoc fixes.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full report

Clarity Security's full report covers the operational detail this post intentionally leaves for the source:

• The three-stage maturity model with the report's full definitions of Inherent Trust, Conditional Trust, and Adaptive Trust
• The underlying breach data and the report's interpretation of why mature identity programmes still leave exposure
• The report's stage-by-stage diagnosis of where human identity, federated access, and non-human identity controls diverge
• The full argument connecting regulatory history, identity governance design, and present-day security outcomes

👉 The full Clarity Security report maps the maturity model and the breach data behind it

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.