TL;DR: 54% of executives now rank AI-enhanced threats as their top 2026 concern, while 43% of practitioners still face credential stuffing and password spraying most often, according to Silverfort’s coverage of The Identity Underground Annual Pulse 2026, showing a widening gap between strategic fear and operational reality. The underlying problem is not awareness but control reach: programmes built for review cycles and legacy estates cannot govern identities moving faster than they are seen.
At a glance
What this is: This is a practitioner-focused read on how identity security is splitting between AI-era planning and day-to-day credential abuse, with visibility into NHI estates emerging as the sharpest governance gap.
Why it matters: It matters because IAM, PAM, and NHI programmes now have to handle legacy identity risk and emerging AI-driven pressure at the same time, without assuming current inventory or review processes are complete.
By the numbers:
- 54% of executives cite AI-enhanced threats as their top concern for 2026.
- 43% of practitioners say credential stuffing and password spraying are still their most frequent attacks.
- 82% say legacy infrastructure actively creates identity security risk.
- Only 5% of organisations feel confident they have a complete inventory of non-human identities.
Context
Identity security is now being shaped by two pressures at once: legacy infrastructure that still carries real access risk, and AI-era threats that are moving into executive planning. The article argues that this is not a simple maturity gap. It is a governance split between what practitioners must stop today and what leaders believe they must prepare for next.
The visibility problem is clearest in non-human identity governance. Service accounts, API keys, and workload identities are proliferating across estates, but traditional ownership and review models were designed around human-centric workflows and stable inventories. When organisations cannot confidently enumerate those identities, they cannot govern their privilege, lifecycle, or exposure with any precision.
Key questions
Q: What breaks when organisations cannot see all of their non-human identities?
A: What breaks is governance itself. Without a complete inventory, teams cannot confirm who owns a credential, whether it still has a valid purpose, or whether it should be rotated or removed. Discovery gaps also hide over-privilege and stale secrets, which means incident response and access review both start from incomplete data.
Q: Why do legacy authentication settings create ongoing identity risk?
A: Legacy settings preserve compatibility but also preserve weak assurance. Older protocols, broad password acceptance, and exception-heavy configurations give attackers more ways to capture, replay, or crack credentials. The longer those settings stay in place, the more likely they are to become the easiest path into the environment.
Q: What are the signs that manual identity response is no longer working?
A: The clearest sign is when detection confidence exists but containment still depends on analysts stitching together logs from multiple systems by hand. If teams need repeated correlation across IdP, PAM, IGA, and SIEM before action can be taken, response is lagging behind the attack. That gap is especially dangerous when identity abuse moves quickly.
Q: How should organisations govern third-party identity access more tightly?
A: Treat third-party access as a lifecycle problem, not a procurement checkbox. Require business ownership, least-privilege entitlements, expiry dates, periodic review, and immediate revocation when the relationship ends. Apply the same standards to partner accounts, support users, and vendor automation tokens that you would expect for internal privileged access.
Technical breakdown
Why identity governance breaks when inventories are incomplete
Identity governance depends on knowing what exists before you can control what it can do. In NHI environments, that means service accounts, API keys, workload identities, and third-party access paths must be visible enough to assign ownership, scope, and review cadence. The article’s central point is that many programmes still operate with partial inventory and legacy assumptions, so the control plane is already behind the estate. That gap is not just operational. It means access reviews, lifecycle controls, and privilege decisions are all based on an incomplete map.
Practical implication: treat incomplete NHI inventory as a governance failure, not a discovery problem to defer.
How legacy authentication amplifies identity security risk
Legacy authentication mechanisms such as NTLM persist because business systems still depend on them, but they widen attack options and complicate modern control design. When old protocols coexist with newer identity layers, teams inherit inconsistent assurance, fragmented logging, and harder-to-enforce policy boundaries. That matters because the environment becomes easier to attack and harder to normalise. The article’s tension is that organisations are modernising on paper while still carrying authentication debt that attackers can continue to exploit.
Practical implication: map legacy authentication dependencies before layering new controls over them.
Why real-time detection matters more than manual identity triage
Identity attacks now move at machine speed, which makes manual correlation a weak containment model. The article describes teams stitching together IdP, PAM, IGA, and SIEM data by hand, which may be workable for investigation but not for response. Detection confidence without automated response is a false comfort if the attacker can move before the analyst finishes correlation. The technical issue is response latency, not just detection quality. Controls must shorten the path from signal to containment.
Practical implication: measure the time from identity signal to containment, not just whether the alert was seen.
Threat narrative
Attacker objective: The attacker aims to turn weak identity hygiene and blind spots in non-human identity governance into persistent access and broader identity abuse.
- Entry begins with credential stuffing or password spraying against exposed identity surfaces, a pattern the article says remains common for practitioners.
- Escalation occurs when legacy infrastructure, weak visibility, or unmanaged non-human identities give the attacker more access paths than the programme can currently inventory.
- Impact follows when identity teams rely on manual correlation and cannot contain the abuse before the attacker moves further through the environment.
Breaches seen in the wild
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
- Stryker Microsoft Intune Wiper Attack: Compromised Microsoft Intune credentials enable wiper attack wiping 200,000 Stryker devices.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity security now has an inventory problem before it has a response problem. The article shows that organisations are trying to govern estates they cannot fully enumerate, especially across non-human identities. When 5% of organisations believe they have a complete NHI inventory, lifecycle governance is already operating on partial truth. The practitioner conclusion is blunt: you cannot assign accountability, risk, or review to identities you have not mapped.
Legacy identity debt is now an attack surface, not just technical inertia. NTLM and similar inherited dependencies are not neutral baggage when they continue to shape authentication paths and control boundaries. They create a split estate where modern policy meets old protocol behaviour. The implication for practitioners is that modernisation plans must treat authentication debt as an active security constraint, not a background architecture issue.
Human-paced identity operations are mismatched to machine-speed abuse. The report’s picture of teams manually stitching together IdP, PAM, IGA, and SIEM data captures a structural control lag. That lag is what lets identity abuse continue even when confidence in detection remains high. The field needs to stop treating manual triage as a viable operating model for real-time identity defence.
Non-human identity frontier: service accounts, API keys, workload identities, and third-party credentials are now large enough to define their own governance boundary. They do not fit human ownership assumptions, and the article’s data suggests most programmes still treat them as exceptions instead of first-class identities. The practitioner conclusion is that NHI governance must be designed as a distinct operating model, not folded into human IAM by default.
What this signals
Identity security programmes need a clearer boundary between human IAM and non-human identity governance. The article’s strongest signal is that visibility gaps are no longer abstract. When service accounts, API keys, and workload identities are spread across business-critical systems, governance has to move from periodic review to continuous ownership and lifecycle control.
Legacy authentication should now be treated as a risk multiplier for modern identity strategy. Teams do not need a separate conversation about AI-era threats if they are still carrying authentication debt that weakens policy consistency. The practical programme response is to understand which old dependencies remain in production and how much they distort current control design.
Manual correlation is not a sustainable containment model for identity attacks. If your incident workflow still depends on humans bouncing between IdP, PAM, IGA, and SIEM data, the programme will struggle the moment identity abuse speeds up. The operational challenge is to shorten the path from signal to action without waiting for perfect consolidation.
For practitioners
- Map the full non-human identity estate Inventory service accounts, API keys, workload identities, and third-party access paths with named ownership and business purpose attached to each item.
- Reduce legacy authentication exposure Identify where NTLM and other inherited authentication paths still support business operations, then prioritise those dependencies for containment and retirement planning.
- Replace manual identity triage with measurable response paths Define the handoff from IdP, PAM, IGA, and SIEM signals to containment actions so response time is governed, not improvised.
- Set separate governance rules for third-party access Treat external companies with system access as a lifecycle and accountability problem, with review, revocation, and owner assignment tracked independently from employee access.
Key takeaways
- Identity security is being pulled between future-facing AI concerns and present-day credential abuse, and that split is widening rather than resolving itself.
- The clearest structural gap is visibility into non-human identities, where organisations are still struggling to assign ownership and governance at scale.
- Practitioners need to treat inventory completeness, legacy authentication debt, and response latency as linked control issues, not separate workstreams.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on unmanaged service accounts and third-party access paths that likely exceed least-privilege intent. |
| NHI-01 — Improper Offboarding | The report highlights third-party access and lifecycle gaps that persist because identities are not cleanly retired. | |
| Recommendation — Audit NHI privilege scope and remove standing access that is not tied to a clear business need. Track offboarding for external and machine identities until access, ownership, and recovery paths are closed. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on entitlement visibility, ownership, and control over both human and non-human identities. |
| Recommendation — Review entitlements continuously and align permissions to current business purpose, not inherited access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account inventory and lifecycle control are central to the report's identity security gap. |
| Recommendation — Centralise account management so every active identity has an owner, purpose, and review path. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Credential stuffing and identity abuse are the attack patterns practitioners still face most often. |
| Recommendation — Map repeated credential abuse to TA0006 and hunt for follow-on movement enabled by identity compromise. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Identity Inventory: Identity inventory is the process of discovering and recording every identity that can access systems or data. For NHIs, it includes owner, purpose, privilege scope, lifecycle status, and where the credential is used. Without inventory, governance, audit evidence, and incident response all become partial and unreliable.
- Legacy Authentication Debt: Legacy authentication debt is the accumulated risk created when older protocols or inherited access mechanisms remain in production after modern controls are introduced. It is not just technical ageing. It constrains visibility, weakens policy consistency, and keeps attack paths alive that modern governance models were not built to absorb.
- Identity response latency: Identity response latency is the time between detecting suspicious identity behaviour and containing it. Lower latency matters because account takeover, MFA compromise, and session abuse can compound quickly. When latency is high, even strong detection can fail to prevent fraud, trust erosion, or operational overload.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org