Identity threats outpace resilience as NHI and AI governance lag

At a glance

What this is: This SANS survey, published by P0 Security, shows that identity security tooling has not translated into containment resilience, with attacks increasingly succeeding after authentication rather than at the login screen.

Why it matters: It matters because IAM, NHI and PAM teams have to govern what valid identities can do after entry, not just how they authenticate or how fast incidents are detected.

By the numbers:

• 68% of organisations detect identity attacks within 24 hours.
• 55% contain them within the same 24-hour window.
• 92% of organisations fail to rotate most NHI credentials on a 90-day cycle.
• 74% are already using AI agents or automations that require credentials.

👉 Read P0 Security's analysis of identity threats, NHI governance and AI-agent credential risk

Context

Identity resilience is not the same as identity detection. The survey points to a governance gap where organisations can spot identity attacks quickly but still fail to contain the blast radius once a valid identity is compromised or abused.

The article places particular emphasis on non-human identities and AI agents because both expand the number of credentialed actors that can bypass human-centred governance assumptions. In practice, that shifts the identity problem from login control to post-authentication authority, lifecycle discipline and session containment.

For NHI and IAM teams, the uncomfortable message is that deployment coverage alone no longer proves control maturity. If service accounts, tokens and agent credentials are not governed by issuance, scope and revocation discipline, the programme remains exposed even when detection looks strong.

Key questions

Q: What breaks when identity attacks are detected quickly but not contained quickly?

A: The control model breaks at the point where valid access still has enough authority to do damage. Fast detection does not prevent token abuse, overprivileged session activity or delegated access from spreading impact. If containment lags behind detection, identity security is measuring alert speed rather than limiting blast radius.

Q: Why do post-authentication identity attacks create more risk than login failures?

A: Because the attacker is operating through a valid identity after authentication, which bypasses the assumptions built into login-centric controls. Once tokens, sessions or delegated permissions are active, the key issue becomes what that identity can still reach, not how it first entered. That is why containment and entitlement scope matter more than authentication alone.

Q: What are the signs that NHI governance is failing in an enterprise?

A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys. Other red flags are excessive permissions, third-party exposure without controls, and low visibility into where non-human identities exist or how they are used across the stack.

Q: How should organizations manage credentials for AI agents?

A: Organizations should transition from hard-coded credentials to runtime-fetched credentials that enhance security by ensuring that tokens are not stored permanently. Utilizing solutions like the MCP Secret Wrapper can help eliminate the risks associated with static credentials.

Technical breakdown

Why post-authentication abuse defeats login-centric controls

Modern identity attacks increasingly exploit valid sessions, tokens and overprivileged service accounts after authentication, which means the initial login event is no longer the decisive control boundary. Once an identity is accepted, the attacker can act through OAuth grants, token replay, delegated permissions or session hijacking without repeating the original access step. This changes the technical centre of gravity from authentication success to session authority, entitlement scope and revocation speed. Identity security tools that stop at detection miss the operational question of what a valid identity can still do once it is inside the environment.

Practical implication: move controls upstream to session and entitlement containment, not just authentication monitoring.

Why non-human identity rotation becomes a lifecycle failure

Non-human identities are operational credentials such as service accounts, API keys, tokens and certificates. Their risk rises when credentials persist longer than the task or relationship that created them, because long-lived secrets widen the compromise window and make offboarding inconsistent. The survey’s 90-day rotation finding matters because rotation is not only a hygiene metric; it is a governance signal about whether machine identities are being managed as living assets with ownership, scope and expiry. Without that discipline, credential exposure and reuse become structural rather than exceptional.

Practical implication: treat NHI rotation as lifecycle governance with ownership and expiry, not as an occasional maintenance task.

How AI agents change the identity governance model

AI agents complicate identity governance because the credentialed actor is no longer a passive workload. An agent can request, combine and use credentials across tools during execution, which means its access pattern can change within a single session. That creates a governance mismatch for models built around stable users, fixed roles and periodic review. The article’s point is not that AI is universally autonomous, but that any credentialed agent or automation already stretches existing controls if the programme assumes access is static, reviewable and human-paced.

Practical implication: classify agent credentials separately and govern them by task scope, tool scope and revocation boundary.

Threat narrative

Attacker objective: The objective is to convert valid identity access into sustained post-authentication control, broader reach and measurable business impact before defenders contain the session.

1. Attackers obtain or abuse valid identity material and then operate through authenticated access rather than noisy initial intrusion.
2. They move into post-authentication activity such as token abuse, OAuth paths or overprivileged service accounts to expand what the identity can do.
3. They escalate impact by turning valid authority into broader access, data exposure or longer dwell time before containment closes the session.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity resilience now fails after authentication, not before it. The survey shows that detection speed is improving faster than containment outcomes, which means organisations are solving the front door while leaving the interior unsecured. Once a valid identity is active, token abuse, OAuth delegation and overprivileged service accounts determine the real attack surface. Practitioners should treat post-authentication authority as the primary control boundary.

Non-human identity governance is still being run like an optional hygiene exercise. The finding that 92% of organisations fail to rotate most NHI credentials on a 90-day cycle is not just a rotation problem, it is a lifecycle governance problem. It shows that many programmes still do not know who owns machine credentials, how long they live, or when they should be revoked. The operational implication is that NHI governance has not been absorbed into core identity management discipline.

AI agents expose the weakness of human-paced governance assumptions. The survey’s 74% figure is important because it shows credentialed agent use is already widespread while governance remains immature. That combination breaks the assumption that access is assigned to a stable human or workload and then reviewed later. Once credentials can be acquired and used within execution, access review becomes a weak control unless issuance, tool scope and termination are enforced in real time.

Ephemeral access without real revocation is identity theatre. Many teams talk about modern identity controls as if short-lived access alone is enough, but the survey points to a different problem: valid access can still be overpowered, overextended and under-contained. The decisive control variable is not whether identity is present, but whether its authority collapses quickly enough after use or compromise. That is a programme design issue, not a tool checkbox.

Identity blast radius has become the metric that matters most. The article shows that organisations can appear mature on detection while remaining brittle on containment, especially where service accounts and agents accumulate wide permissions. The field should stop measuring identity security by deployment count and start measuring how much damage a valid identity can do before revocation. That is the governance standard practitioners now have to meet.

What this signals

Identity security programmes now need a containment-first design. The report shows that attack discovery and attack containment are no longer moving in lockstep, so the operational question is not whether identity events are visible but whether the programme can limit what a valid identity does once it is compromised. That pushes teams toward tighter entitlement boundaries, faster revocation and narrower session authority.

Post-authentication control is the new identity perimeter. Once service accounts, OAuth grants and agent credentials are active, the practical perimeter is no longer the login page. Organisations should expect board-level questions about who can revoke authority, how quickly privileges collapse and whether machine identities are still being treated like static assets.

Credentialed agents and service accounts require separate governance lanes. Human access review processes assume a stable user with a durable entitlement history. Credentialed agents and NHIs can change scope much faster, so their governance has to be anchored in issuance, expiry and task scope rather than periodic certification.

For practitioners

• Map post-authentication blast radius Inventory what valid identities can do after login, including tokens, OAuth grants, service accounts and delegated permissions. Use that mapping to identify the identities whose compromise would create the largest containment problem.
• Enforce ownership and expiry for NHI credentials Assign a clear owner, expiry expectation and revocation path to every service account, API key and token. If a credential cannot be tied to a current business purpose, remove it from active use.
• Separate AI agent credentials from human access reviews Treat credentialed agents and automations as their own population. Define task scope, tool scope and termination conditions so that review cycles do not rely on a stable human operator being present.
• Measure containment, not just detection Track how often identity incidents are contained within the same window in which they are detected, and compare that result against the identities with the widest permissions. If containment lags, the programme is still overexposed.
• Reduce overprivilege before the next review cycle Prioritise service accounts and machine identities with standing privilege or broad OAuth reach. Narrow their permissions first, because those identities are most likely to amplify a compromise into lateral movement.

Key takeaways

• Identity security maturity cannot be judged by detection speed alone when containment still lags behind compromise.
• The survey points to a widening governance gap around non-human identities and credentialed AI agents, especially where lifecycle control is weak.
• Practitioners need to prioritise post-authentication containment, credential expiry and privilege scope if they want resilient identity security.

Key terms

• Post-Authentication Abuse: Post-authentication abuse happens when an attacker uses valid credentials to perform actions after login rather than breaking authentication itself. For NHI environments, this often means abusing tokens, service accounts, or delegated access to query data, move laterally, or establish persistence while appearing legitimate to basic login controls.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Containment window: The containment window is the time between detecting an identity incident and limiting what the identity can still do. A short window matters because valid credentials can remain useful to an attacker even after the alert fires.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full report

P0 Security's full report covers the operational detail this post intentionally leaves for the source:

• Survey methodology and independent sampling context behind the 2026 SANS findings
• Breakdowns of identity attack stages after authentication, including token abuse and OAuth paths
• The full NHI credential rotation data and the governance gaps behind it
• The report's detail on AI agent and automation credential use across organisations

👉 P0 Security's full report covers the survey detail behind post-authentication abuse, NHI rotation gaps and AI agent governance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.