TL;DR: Traditional IAM tools miss most non-human identities because they track credentials and silos, not the identities, owners, and relationships that create real risk, according to SPHERE Technology Solutions and Gartner. That blind spot becomes more dangerous as service accounts, orphaned identities, and AI agents multiply faster than manual governance can keep up.
At a glance
What this is: This is an argument for identity visibility and intelligence as the control gap behind machine identity sprawl, orphaned service accounts, and AI agent growth.
Why it matters: It matters because IAM teams cannot govern what they cannot inventory, assign ownership to, or trace across systems, especially as non-human identities outnumber humans at enterprise scale.
Context
Identity visibility is the ability to know what identities exist, who or what owns them, and where they are used across an environment. The security gap appears when teams manage credentials in silos but cannot connect those credentials to the underlying human or machine identity.
In this article, the governance problem is not a lack of authentication controls. It is a lack of identity intelligence across service accounts, orphaned accounts, and emerging AI agents, which makes lifecycle control and accountability incomplete.
That failure mode is already typical in many enterprise environments, not an edge case. The article argues that traditional IAM was built for a different identity model and now misses most of the identity estate.
Key questions
Q: Why do service accounts and machine identities matter under NIS2?
A: Service accounts and machine identities matter because they often carry the permissions that move data, trigger reports, and feed AI workflows. If those identities are over-privileged or left out of review cycles, the organisation cannot prove that access is proportionate or necessary. Under NIS2, that creates both security exposure and audit weakness.
Q: When does identity visibility become more important than credential management?
A: Identity visibility becomes the priority whenever the organisation cannot answer who owns an account, why it exists, or where it is used. At that point, credential rotation alone is only treating symptoms. The control problem is ownership and scope, not just authentication hygiene.
Q: What are the signs that service account governance is failing in an organisation?
A: Common warning signs include accounts with no clear owner, broad permissions that exceed job need, credentials stored in insecure places such as code or configuration, and service accounts that survive staff departures without reassignment. Another sign is the inability to answer who uses the account, when it was last reviewed, or whether its access still matches the application it supports.
Q: How should IAM teams govern AI agent identities differently from static service accounts?
A: IAM teams should treat AI agent identities as a separate privileged class because access can be exercised through changing tasks, tools, and contexts. That means scoping must cover tool boundaries and task purpose, not just account creation, and governance needs stronger runtime visibility than a static account model provides.
Technical breakdown
Why credential-centric IAM misses the identity layer
Traditional IAM often treats a credential as if it were the identity itself. In practice, the credential is only evidence of authentication, while the identity is the accountable entity, human or machine, that owns purpose, scope, and lifecycle. When tools are organised around directories, PAM, or governance silos, they may know an account exists but still miss ownership, dependency chains, and whether the identity is legitimate. That is why orphaned service accounts and hidden machine identities persist even in mature environments. Practical implication: teams need identity-level inventory, not just account-level reporting.
Practical implication: build inventory around identity ownership and purpose, not just account existence.
How machine identity sprawl changes the attack surface
Machine identities scale differently from human accounts because they are embedded in applications, scripts, databases, and automation workflows. They often run continuously, hold persistent access, and multiply faster than manual review processes can keep up. The risk is not just volume. It is blast radius: one over-privileged service account can unlock multiple downstream systems and related identities. Traditional audit snapshots struggle here because the environment changes faster than review cycles. Practical implication: discovery, ownership mapping, and privilege scope need to be continuous, not periodic.
Practical implication: treat machine identity discovery and privilege scope as continuous controls.
Why AI agents turn identity visibility into a governance problem
AI agents are not simply another form of automation. According to the article, they can make decisions, adapt behaviour, and even create temporary identities for tasks, which means the identity state may change during execution. That creates a governance challenge for controls that assume stable assignment, predictable usage, and reviewable access. Once an identity can request, use, and discard privilege inside a task, the control point moves from later review to issuance-time governance. Practical implication: visibility must extend into runtime behaviour and delegation, not just provisioning records.
Practical implication: extend governance to runtime behaviour when identities can act and reconfigure themselves dynamically.
Threat narrative
Attacker objective: The objective is to exploit hidden or over-privileged non-human identity pathways to reach systems, data, and automation that traditional IAM does not accurately govern.
- Entry begins when a machine identity or service account is created with poor ownership, hidden placement, or reused credentials across systems.
- Credential access follows when that identity is found, reused, or compromised, giving an attacker or rogue process valid authentication to downstream services.
- Escalation occurs when the account carries persistent privilege or broad relationship trust, allowing movement into adjacent systems and identities.
- Impact comes when the exposed identity is used to reach sensitive data, automate unauthorised actions, or sustain hidden access across the environment.
Breaches seen in the wild
- Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity visibility, not credential inventory, is the missing control plane: The core problem in this article is that most organisations still govern secrets, tokens, and accounts without a reliable picture of the identities behind them. That is a structural gap, because ownership, purpose, and relationship context are what make access governable. When those elements are missing, identity governance becomes reactive and incomplete. The implication is that visibility must shift from authentication artefacts to accountable identity objects.
Machine identity sprawl exposes a blast-radius problem, not just a scale problem: The article shows that machine identities outnumber human identities by a wide margin, but the real issue is the network of dependent access they create. One over-privileged service account can cascade across applications, containers, databases, and scripts, turning a single blind spot into a wide attack surface. This is where manual governance stops being credible. Practitioners need to think in terms of relationship mapping and access propagation, not simple account counts.
Orphaned service accounts are a lifecycle failure, not a discovery nuisance: A service account without an owner is not merely hidden, it is unmanaged. That means joiner-mover-leaver processes, recertification, and offboarding logic are missing the non-human estate entirely. The article’s 67% orphaned-service-account figure shows that this is not an edge condition. Practitioners should treat ownership assignment as a control, not an administrative afterthought.
Autonomous identity behaviour breaks the assumption that access is stable long enough to review: Access review processes were designed for identities whose privileges persist across a review cycle. That assumption fails when an AI agent can decide, act, and even create temporary identities within a task because there may be no stable access state left to certify. The implication is that governance has to move toward issuance-time and runtime controls, not depend on retrospective review alone.
IVIP is a named response to a named gap, but the category only matters if it changes governance outcomes: The article positions Identity Visibility and Intelligence Platforms as the layer that connects discovery, context, and remediation across identity types. That makes sense only if the platform closes the ownership and dependency gap that existing IAM tools leave open. Practitioners should evaluate it as a governance capability, not as another inventory dashboard.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide
What this signals
Identity visibility is becoming a governance prerequisite: IAM programmes that still centre credentials will keep missing ownership, dependency, and purpose, which means they will also keep missing the identities most likely to create hidden risk. The practical shift is from account administration to identity governance across the full lifecycle.
Machine identity sprawl demands relationship mapping: The ratio of machine identities to humans is no longer manageable with periodic review alone. Practitioners need to see which identities are connected, which ones inherit privilege, and which ones can still operate after their owner, application, or pipeline has changed.
AI agent governance will expose whether identity programmes are lifecycle-aware: If a team cannot govern temporary or adaptive access, it will struggle to govern autonomous behaviour safely. The next maturity test is whether visibility and controls reach the point where access is understood at creation, not discovered after the fact.
For practitioners
- Build an identity-first inventory Map every human and non-human identity to an owner, purpose, system scope, and last-used signal before trying to rationalise credentials.
- Separate identities from credentials in governance workflows Update IAM and PAM workflows so the review unit is the identity object, not the password, token, or certificate attached to it.
- Continuously discover hidden machine identities Scan application configs, scheduled tasks, scripts, database connections, and cloud automation paths to find service accounts outside directories.
- Right-size privileged non-human access Review service accounts with broad or persistent access and reduce scope wherever the identity can complete its task with narrower permissions.
- Treat AI agent identity as runtime governance Define who can create, approve, and constrain temporary agent identities before autonomous behaviour starts producing unmanaged access paths.
Key takeaways
- Most organisations still govern credentials better than they govern identities, which leaves ownership and purpose blind spots across human and machine access.
- Machine identity sprawl turns a visibility problem into a blast-radius problem because one over-privileged account can connect to many downstream systems.
- Identity intelligence matters because the control point is shifting from periodic review to continuous discovery, ownership mapping, and runtime governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on overly broad access across service accounts and machine identities. |
| NHI-01 — Improper Offboarding | Orphaned service accounts and missing ownership are lifecycle failures central to the article. | |
| Recommendation — Reduce broad machine identity entitlements and align access scope to actual task requirements. Track ownership and revoke non-human identities that no longer have a valid business purpose. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article discusses credential management gaps for service accounts and machine identities. |
| Recommendation — Apply authenticator lifecycle controls to remove stale credentials and tighten issuance governance. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about missed visibility into permissions and identity relationships. |
| Recommendation — Inventory and review entitlements continuously so hidden identities do not retain unchecked access. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article’s risk story includes compromised service accounts and downstream spread across systems. |
| Recommendation — Map hidden service account exposure to credential access and lateral movement detection priorities. | ||
Key terms
- Identity Intelligence: Identity intelligence is the layer that turns raw identity data into context about risk, usage, and privilege. It helps teams distinguish harmless access from materially risky access by linking identity records, entitlement patterns, and behavioural signals, which is essential when non-human identities scale faster than manual review.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
- Identity Visibility and Intelligence Platform: An Identity Visibility and Intelligence Platform is a layer that correlates identity data across multiple tools into one risk picture. It does not replace existing controls. It makes them more useful by connecting events, relationships, configuration, and posture so teams can prioritise what matters.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 22, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org