Identity threats outpace resilience as NHI and AI governance lag

At a glance

What this is: This report says identity security deployment is outpacing actual resilience, with containment lagging detection and NHI and AI governance emerging as the weakest points.

Why it matters: It matters because IAM, PAM and NHI programmes can look mature on paper while still failing to limit post-authentication abuse, unmanaged credentials and machine-driven access.

By the numbers:

• 68% of organizations detect identity attacks within 24 hours, according to P0 Security.
• 55% of organizations contain identity attacks within the same 24-hour window, according to P0 Security.
• 92% of organizations fail to rotate most NHI credentials on a 90-day cycle, according to P0 Security.
• 74% of organizations are already using AI agents or automations that require credentials, according to P0 Security.

👉 Read P0 Security’s report on 2026 identity threats and defenses survey insights

Context

Identity security is not only about preventing login. Once an identity is authenticated, the real question is how much damage it can do through sessions, tokens, OAuth paths and privileged machine accounts.

This survey report from P0 Security, based on SANS findings, shows a widening gap between tool deployment and operational resilience. The article frames that gap across human identity, non-human identity and AI-assisted access.

For IAM and PAM teams, the practical issue is no longer whether controls exist. It is whether those controls meaningfully constrain post-authentication behaviour, credential rotation and delegated access across the full identity estate.

Key questions

Q: What breaks when identity governance stops at login events?

A: Teams lose visibility into the actions that happen after authentication, including token reuse, secret harvesting, and privilege escalation. Attackers increasingly operate through valid identities, so the compromise may never look like a failed login. Governance has to extend into execution, privilege use, and artifact handling.

Q: Why do long-lived credentials create more operational risk in multi-environment NHI estates?

A: Long-lived credentials increase risk because they expand the window for misuse, persistence, and lateral movement across cloud, SaaS, and on-premises environments. They are harder to trace and easier to overuse than ephemeral identities. Teams should prioritize converting the highest-impact credentials first, especially where access is broad, repetitive, or tied to sensitive resources.

Q: How should organisations govern AI systems that need credentials?

A: Organisations should place AI systems inside the non-human identity inventory and assign each one a clear owner, scope, and offboarding path. If an AI feature can authenticate, call tools, or hold tokens, it needs lifecycle governance. Without that, hidden access paths can outlive visibility and accountability.

Q: How do you know if an identity programme is actually resilient?

A: A resilient programme can shorten the gap between seeing identity abuse and stopping the identity from acting. If an organisation detects faster than it contains, it still has a post-authentication exposure problem. The practical test is whether sessions, tokens, service accounts and agent credentials can be constrained before damage spreads.

Technical breakdown

Why post-authentication abuse is now the main identity threat

Modern identity attacks often begin with valid access rather than broken authentication. Once a session, token or OAuth grant is active, the attacker can operate inside trusted control paths instead of fighting the login flow. That shifts the defensive problem from entry prevention to privilege containment. Overprivileged service accounts make this worse because they can be used for lateral movement, data access or administrative action without triggering the same alarms as a user account takeover. In practice, identity protection has to account for what authenticated identities can do, not just how they sign in.

Practical implication: map post-authentication actions and restrict the permissions that remain available after a session is established.

Why NHI rotation gaps create persistent exposure windows

Non-human identities are not a side issue when they are the fastest-growing identity category and still carry long-lived credentials. Service accounts, API keys, tokens and certificates often persist far longer than human access, which means compromise windows stay open until rotation or revocation catches up. A 90-day cycle is already a weak control if the credential is highly privileged or widely reused. The deeper problem is that NHI governance is often fragmented across application teams, cloud teams and platform owners, so no one has a complete view of ownership, rotation and offboarding.

Practical implication: inventory all NHIs, assign ownership and enforce credential rotation and revocation as lifecycle controls, not ad hoc tasks.

How AI agents change the access-governance model

AI agents become an identity problem when they require credentials to act on systems, data or workflows. Even when the agent is not fully autonomous, it still needs scoped access, approval boundaries and revocation logic. The survey points to immature and inconsistent governance, which is a strong sign that many organisations are treating agent access like ordinary automation. That is insufficient because agent credentials can expand the blast radius of a workflow if they are not bound to task scope, data scope and execution scope. The governance model has to assume machine-driven use of privileges, not human-paced review cycles.

Practical implication: classify AI agents as governed identities and tie their credentials to task-scoped access, auditability and clear ownership.

Threat narrative

Attacker objective: The attacker aims to turn a legitimate identity into durable access that can move, read or act across systems without immediate containment.

1. Entry often occurs through a valid session, token or OAuth grant rather than a stolen password or failed login.
2. Escalation follows when the authenticated identity has broad permissions or service-account level access that can be reused beyond the original task.
3. Impact comes from post-authentication abuse such as data access, lateral movement or delegated actions that remain inside trusted identity paths.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Containment has become the real identity-security benchmark: the gap between 68% detection within 24 hours and 55% containment shows that many programmes can see identity abuse faster than they can stop it. That matters because identity incidents now compound after authentication, where tokens, sessions and delegated access keep working. The practitioner conclusion is simple: resilience is defined by how quickly valid access is constrained, not how quickly an alert is raised.

Non-human identity governance is no longer a niche control problem: the report’s 92% rotation failure figure points to a structural lifecycle weakness, not a hygiene miss. Service accounts and machine credentials persist because ownership, rotation and offboarding are split across teams and systems. The implication is that NHI lifecycle governance must be treated as a core identity programme capability, not as an operational afterthought.

Credentialed AI agents expose a new governance debt: 74% adoption with immature governance means many organisations are creating access paths before defining the rules that should bound them. That is not just an implementation gap, it is a programme design flaw. The practitioner conclusion is to govern agent identity at issuance, scope and revocation, because review-only models arrive too late.

Identity blast radius is now the right control lens: the report makes clear that once identity is inside, the issue is how far it can move, what it can call and which sessions it can extend. That reframes PAM and IGA decisions around the effective radius of a valid identity rather than the existence of login controls. Teams should measure how much damage a compromised identity can still do after authentication.

Post-authentication security should replace login-centric thinking: the strongest signal in the survey is that the old boundary between authentication and compromise is no longer enough. Modern identity defence has to combine session control, OAuth governance, NHI lifecycle discipline and agent oversight into one operational model. The practitioner takeaway is to rebase control design on authenticated behaviour, not entry events.

What this signals

Identity resilience now depends on post-authentication control: if sessions, tokens and delegated grants remain active after compromise, the programme is still optimised for detection rather than containment. Teams should rework response playbooks so identity restriction happens while the session is still live, not after the alert is triaged.

Non-human identity lifecycle is becoming the programme’s weakest governance seam: the fastest-growing identity category is only manageable when ownership, rotation and offboarding are treated as a single lifecycle. That is where many enterprises still have fragmented accountability, and it is where the next governance reset has to start.

Credentialed AI agents should be managed as identities, not tools: once an agent needs credentials, it inherits the same governance questions as service accounts and workloads, including scope, revocation and auditability. Organisations that keep placing agents outside the identity model will keep discovering them only after access has already been used.

For practitioners

• Measure containment separately from detection Track the time from identity-alert creation to actual restriction of sessions, tokens and delegated permissions. Use that metric to identify where response is slowing after valid access has already been established.
• Inventory and assign ownership for every NHI Build a complete register of service accounts, API keys, tokens and certificates, then assign a named owner for rotation, revocation and offboarding. Without ownership, lifecycle controls remain inconsistent and incomplete.
• Bind AI agent credentials to task scope Limit agent access to the exact systems, data and actions needed for a specific workflow, and require clear revocation when the workflow ends. Treat every credentialed agent as a governed identity rather than generic automation.
• Reduce post-authentication privilege breadth Review sessions, OAuth grants and service-account permissions for excessive scope. Remove unnecessary write paths, admin actions and cross-system reach so compromised identities have less room to move.

Key takeaways

• Identity attacks are increasingly succeeding after authentication, which means login-centric controls no longer define resilience.
• The survey shows a clear operational gap between detection and containment, and that gap is where identity incidents now do the most damage.
• NHI rotation discipline and credentialed AI governance are now core identity programme issues, not specialist edge cases.

Key terms

• Post-Authentication Abuse: Post-authentication abuse happens when an attacker uses valid credentials to perform actions after login rather than breaking authentication itself. For NHI environments, this often means abusing tokens, service accounts, or delegated access to query data, move laterally, or establish persistence while appearing legitimate to basic login controls.
• NHI lifecycle governance: NHI lifecycle governance is the set of policies and controls used to manage non-human identities from creation to retirement. It covers approval, issuance, rotation, monitoring, access review, revocation, and deletion for service accounts, API keys, tokens, certificates, and AI agents, so machine identities remain accountable, least privileged, and auditable.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Credentialed AI Agent: An AI system that requires credentials to access data, tools or workflows. The key governance issue is not the model itself, but the access it can exercise, which means scope, ownership, revocation and auditability must be treated as identity controls.

What's in the full report

P0 Security's full report covers the operational detail this post intentionally leaves for the source:

• Survey methodology behind the 2026 identity threats and defenses findings
• More granular breakdowns of post-authentication abuse patterns across sessions, tokens and OAuth
• Additional context on NHI credential rotation failure and AI agent governance maturity
• The full set of survey insights on where identity resilience is breaking down in practice

👉 P0 Security’s full report adds the survey context behind identity detection, containment, NHI rotation and AI agent governance gaps.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.