Identity security now spans human, machine and AI identities

At a glance

What this is: This is CyberArk’s argument that identity security must span human, machine and AI identities, with lifecycle, privilege and governance controls applied across the full estate.

Why it matters: It matters because IAM, PAM and NHI programmes can no longer be designed around a single identity class when access, review and privilege decisions now cross human, workload and AI boundaries.

By the numbers:

• 87% of organizations have experienced at least two successful identity-related breaches.

Context

Identity security is the practice of governing who or what can access resources, when that access exists, and how it is removed or constrained. In this article, the primary issue is not authentication alone but the widening identity surface across human, machine and AI identities.

CyberArk argues that once identities span workforce users, developers, IT, machines and AI, governance can no longer rely on separate control models. The security problem becomes one of privilege control, continuous discovery and lifecycle management across different identity types, including those that operate at machine speed or inside delegated workflows.

The vendor frames this as a response to identity-related breaches and supply chain exposure, but the underlying issue is broader than any one product category. Organisations that still treat human IAM, PAM and NHI governance as separate conversations will miss the way privilege now crosses organisational and technical boundaries.

Key questions

Q: What do organisations get wrong when they treat human, machine, and AI identities the same?

A: They apply one policy model to identities with very different lifecycles, behaviours, and evidence requirements. Human users, service accounts, and AI identities should not share the same review cadence or control assumptions. When they do, governance becomes broad but shallow, and the most risky access paths are usually the least visible.

Q: Why do machine identities complicate identity governance more than human accounts?

A: Machine identities act continuously, at scale, and with delegated authority, so they cannot rely on manual review cycles or human pauses. They often outnumber human users and can trigger downstream systems automatically. That makes runtime enforcement, ownership, and revocation timing much more important than in traditional user IAM.

Q: What breaks when agent access reviews are designed like human access reviews?

A: Agent access reviews break when they assume a stable user, stable role, and stable review interval. AI agents can gain and use access within the same operational cycle, so a periodic review may miss the effective privilege that matters. Governance needs runtime visibility and ownership, not only scheduled certification.

Q: Should organisations converge human IAM, PAM, and NHI governance?

A: Yes, when the same programme needs to govern people, service accounts, and other machine identities under one ownership and certification model. Separate control planes create blind spots, duplicated policy logic, and inconsistent revocation. Convergence gives teams one place to apply lifecycle, privilege, and review discipline.

Technical breakdown

Continuous discovery across human, machine and AI identities

The article points to continuous discovery as the prerequisite for governing identities that are no longer static or neatly inventoried. In practice, this means a control plane must locate workforce accounts, service identities, developer access and AI-linked identities across cloud and on-premises environments, then attach context before access is reviewed or changed. That is a governance problem as much as a visibility problem, because missing identities cannot be recertified, constrained or offboarded. The technical implication is that lifecycle and privilege decisions depend on discovery fidelity, not just on directory completeness.

Practical implication: inventory every identity class first, or your governance controls will only cover the identities you already know about.

Privilege controls for ephemeral and delegated access

The article places privilege at the centre of identity security because modern identities do not behave like long-lived user accounts. Machine and AI identities may be provisioned for a task, delegated through tooling, or adjusted by context and risk signals. That makes privilege boundaries dynamic rather than fixed, so the control challenge is not only limiting access at issuance but also constraining what an identity can do once active. In NHI terms, this is where overprivilege, reuse and long-lived credentials turn into governance debt. For AI and machine identities, the architectural issue is whether access can be scoped tightly enough before runtime behaviour expands it.

Practical implication: move privilege decisions closer to issuance and task scope, especially where machine or AI identities can accumulate excess access mid-workflow.

Lifecycle governance across workforce, machine and AI identities

CyberArk’s lifecycle message is that identities are not static, regardless of whether the subject is a person, a workload or an AI-enabled system. Joiner-mover-leaver governance, access reviews and entitlement management therefore need to apply across the full estate rather than only for employees. The practical significance is that offboarding, role change and access recertification must account for identities that are created automatically, delegated across systems or retired outside human HR workflows. This is where IAM, PAM and NHI disciplines converge into one lifecycle model. Treating machines and AI as outside lifecycle governance leaves gaps that attackers and operational drift both exploit.

Practical implication: extend joiner-mover-leaver and recertification processes to non-human and AI identities, not just human users.

Threat narrative

Attacker objective: The objective is to turn identity compromise into broader system access by exploiting privilege and lifecycle gaps that span multiple identity types.

1. Entry begins when an exposed or overextended identity is compromised, giving an attacker a foothold in a human, machine or AI-controlled access path.
2. Escalation follows when the attacker abuses privilege controls, delegated access or reused credentials to move beyond the original identity boundary.
3. Impact occurs when access across cloud, on-premises or supply chain-linked systems is used to exfiltrate data, disrupt operations or erode trust in the identity layer.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity security is now a cross-actor governance problem, not a single control domain. Human IAM, PAM and NHI governance are converging because privilege decisions now span employees, workloads and AI-enabled systems in one operating model. The old separation between user security and machine identity security leaves blind spots in discovery, review and offboarding. The practical conclusion is that identity governance must be designed around the full estate, not around organisational silos.

Continuous discovery is the new prerequisite for lifecycle control. If an identity is not continuously known, it cannot be reviewed, certified or retired with confidence. That matters most for machine and AI identities, which can appear and disappear faster than manual governance cycles can observe. The result is that lifecycle assurance now depends on machine-readable inventory and context, not periodic reconciliation alone.

Privilege control has moved from account management to runtime constraint. The article’s emphasis on right-sized privilege reflects a broader market shift: organisations are no longer just trying to issue access safely, they are trying to keep access from expanding into unintended workflows. That applies equally to service accounts, delegated machine access and AI-assisted operations. The practitioner takeaway is that privilege governance must be measured by effective scope, not by whether an account exists in the directory.

Access review processes are being stretched beyond their original design assumptions. Access review was built for identities that persist long enough to be observed, challenged and recertified. That assumption becomes fragile when machines and AI identities are created programmatically, used briefly, or chained through other systems. The implication is not merely more review volume, but a redesign of what evidence counts as reviewable identity activity.

Identity-related breaches now reflect governance failure across the full chain of trust. The cited breach rate is a reminder that attackers increasingly benefit from the seams between human, machine and third-party identity controls. Organisations that keep PAM, IAM and NHI programmes separate will continue to leave exploitable gaps at handoff points, not just at login. The field is moving toward integrated identity security because the attack surface already has.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Cross-actor identity governance is becoming the real control plane. Organisations now need to think in terms of identity estates, not identity types. The moment machine and AI identities share workflows with people, the programme has to unify inventory, entitlement review and offboarding around the behaviour of the identity, not the label on it.

Identity blast radius is the concept to watch. As access crosses human, machine and AI boundaries, the practical question is no longer whether an identity exists, but how far a compromised identity can travel through delegated trust. That is why discovery, least privilege and lifecycle governance now have to be evaluated together, not as separate maturity tracks. According to the Ultimate Guide to NHIs, 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.

For practitioners

• Map every identity class to one governance owner Assign explicit ownership for workforce accounts, service identities, developer access and AI-related identities so discovery, review and offboarding do not fall between teams.
• Unify access reviews across human and non-human identities Use a single recertification model that can handle employee access, service account entitlements and delegated machine access with the same control logic.
• Constrain privilege to task scope and runtime context Reduce standing access where possible and require privilege decisions to reflect the specific workflow, environment and identity type in use.
• Treat AI-enabled access as part of identity governance Include AI-linked identities in inventory, entitlement tracking and lifecycle review so delegated access does not escape existing governance routines.

Key takeaways

• Identity security is now a governance issue across human, machine and AI identities, not just a control problem for employees.
• The biggest operational risk is the gap between how identities behave in real workflows and how review, privilege and offboarding processes were designed.
• Organisations need one lifecycle model for all identity types, or blind spots will continue to appear at the handoff points between teams and systems.

Key terms

• Identity Security: Identity security is the discipline of governing who and what can access systems, data, and tools, then proving those decisions are enforced. In practice it spans human users, service accounts, tokens, certificates, and AI agents across the full access lifecycle.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Privilege Controls: Privilege controls are the mechanisms that limit what an identity can do after it is authenticated. In non-human environments, they include scoped credentials, session limits, entitlements, approval rules, and context-based enforcement that reduce the blast radius of compromise.
• Continuous discovery: Continuous discovery is the ongoing process of detecting identities as they appear, change, or disappear across environments. For AI agents and other NHIs, it prevents inventory drift and keeps ownership, privilege, and lifecycle controls aligned with the live environment.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.