TL;DR: Enterprises are operating with an incomplete view of their identity attack surface, even as they manage an average of 50 non-human identities per employee across clouds, SaaS, and AI systems, according to Permiso Security. The visibility gap is now a structural IAM problem because you cannot govern, detect, or respond to identities you have not inventoried.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Permiso Security's blog post: Identity visibility is the first missing layer in NHI programmes, and organisations cannot govern identities they have not inventoried.
Why it matters: It matters because IAM, NHI, and autonomous identity programmes all depend on knowing what exists, what it can reach, and who owns it before detection or response can work.
Context
Identity visibility means having a current, accurate view of every human, non-human, and AI identity, along with its permissions, ownership, and relationships. Permiso Security's central claim is that most security programmes still try to detect and respond before they can inventory the identities already in play, which leaves governance, least privilege, and incident response working from stale assumptions.
The article frames this as an NHI governance problem first and a tooling problem second. Orphaned accounts, API keys, machine identities, and AI agents can persist across cloud, SaaS, identity providers, and CI/CD environments, so the control gap is not lack of alerts but lack of identity discovery and lifecycle awareness.
Key questions
Q: What breaks when organisations do not have visibility into identity behavior and entitlements?
A: Without visibility into behavior and entitlements, teams lose the ability to distinguish normal access from suspicious activity. That weakens detection of account takeover, insider misuse, and credential abuse. It also slows incident response because analysts cannot quickly trace actions back to the identity involved, the assets touched, or the scope of access that must be contained.
Q: Why do incomplete identity inventories create access risk?
A: Because every downstream control assumes the inventory is accurate. If the estate is incomplete, reviews certify only what is visible, privilege drift persists unnoticed, and orphaned access can survive long enough to matter. Visibility is not a reporting metric here. It is the prerequisite for deciding whether access is still justified.
Q: How do you know if identity visibility is actually improving security?
A: Visibility is only improving security if it leads to fewer uncontrolled access paths and more decisions enforced at the point of use. If discovery produces better reports but no change in runtime policy, the programme has improved knowledge, not control. The best indicator is whether the same identity that can be seen can also be constrained before it acts.
Q: Should teams prioritise identity visibility before detection and response?
A: Yes, because detection and response depend on knowing which identities are legitimate and which ones are out of scope. Without that baseline, security teams cannot separate normal automation from shadow identities, or active risk from stale records. Visibility is the prerequisite control that makes downstream monitoring and containment credible.
Technical breakdown
Why static identity inventories fail across cloud, SaaS, and CI/CD
Identity inventories go stale because identities are created, delegated, and retired continuously across multiple systems. In practice, service accounts, API keys, and machine identities are scattered across cloud providers, SaaS apps, identity providers, and deployment pipelines, so any snapshot misses the relationships that determine real access. The technical problem is not just enumeration; it is keeping identity state aligned with trust paths, environment changes, and ownership changes as they happen. Practical implication: security teams need continuous discovery rather than periodic audits if they want their identity data to remain operationally useful.
Practical implication: Treat identity discovery as a continuous control, not a quarterly review.
Why relationship mapping matters more than a flat account list
A flat list of identities cannot show who can reach what through federated access, indirect permissions, or privilege escalation paths. The article's Universal Identity Graph concept is really about contextualising identity data so teams can see direct and indirect reach, cross-environment trust, and hidden dependencies. That matters because many exposures only become visible when identities are analysed as a graph rather than as isolated records. Practical implication: identity programmes should model relationships, not just count accounts, if they want to understand blast radius.
Practical implication: Map indirect access paths and trust boundaries, not just identity names.
How visibility becomes the foundation for detection and response
Detection and response controls assume the defenders know which identities exist, what normal looks like, and which identities should be present in the first place. When inventory is incomplete, alerting, least-privilege enforcement, and incident triage all begin with uncertainty. Real-time identity visibility also shortens the time to answer basic incident questions such as which identities were active, who owned them, and what systems they could reach. Practical implication: ITDR and post-incident investigation improve only after the identity base layer is current and complete.
Practical implication: Build ITDR on top of current identity inventory, not as a substitute for it.
Threat narrative
Attacker objective: Use unmanaged identities to move into systems and data that defenders do not realise are still reachable.
- Entry occurs when orphaned service accounts, API keys, or AI agent identities remain active after the business or technical need has ended.
- Credential access is effectively standing access because the credentials still work, even though no one is actively governing them.
- Impact follows when hidden identities provide an unseen path to sensitive systems, customer data, or production workloads.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity visibility is now a control plane problem, not a reporting problem. When organisations cannot see all humans, NHIs, and AI identities in one place, every downstream control inherits that blindness. Detection, response, least privilege, and compliance all depend on an inventory that is current enough to trust, so visibility has to sit at the front of the programme.
Ephemeral credential trust debt is the new operational risk in identity programmes. The longer credentials, tokens, and delegated identities persist without a clean ownership model, the more likely they are to outlive the workflow, project, or vendor relationship that justified them. That creates exposure that is structurally invisible to teams that still think in static account registers. Practitioners should treat stale identity state as accumulated risk, not administrative noise.
Universal Identity Graph is the right concept for the problem, even when the tooling differs. Security teams need to understand identities as relationships across trust boundaries, not as isolated objects. That approach is what exposes indirect access, cross-environment reach, and third-party paths that flat inventories routinely miss. The practical conclusion is simple: if the graph is incomplete, the security programme is incomplete.
NHI governance fails when lifecycle ownership is fragmented across cloud, SaaS, and AI operations. Service accounts, API keys, machine identities, and AI agents often have no single accountable owner, which means offboarding, rotation, and access review drift apart. The result is not just excess access, but unresolved accountability across the identity estate. Teams need a governance model that assigns ownership before they can meaningfully govern access.
Identity visibility is the prerequisite for autonomous-system oversight as well as classic NHI control. AI agents with delegated access are only governable if teams can see where they exist, what they can reach, and who can revoke them. Without that inventory, organisations cannot separate legitimate automation from unmanaged shadow AI. The lesson is that autonomous identity governance starts with the same visibility discipline as service-account governance.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide
What this signals
Identity visibility is the control layer that determines whether every other identity function is operating on facts or assumptions. For IAM teams, that means the programme conversation has to shift from buying more monitoring to maintaining a live estate of humans, NHIs, and AI identities. When the inventory is stale, least privilege and response are both built on guesswork, not governance.
Ephemeral credential trust debt: identities that persist longer than the workflow that created them accumulate unmanaged risk across cloud, SaaS, and AI environments. The operational signal is not simply volume, but unresolved ownership and delayed retirement of access that no longer has a business purpose. Treat that as a lifecycle failure, not an exception list.
Service accounts remain the clearest visibility gap in many enterprises, which is why current-state discovery should be treated as a baseline control rather than a nice-to-have. according to the Ultimate Guide to NHIs
For practitioners
- Establish continuous identity discovery Inventory humans, service accounts, API keys, machine identities, and AI agents across cloud, SaaS, identity providers, and CI/CD pipelines with continuous updates instead of periodic scans.
- Map identity relationships and reachability Document direct and indirect access paths, federated trust links, and privilege escalation routes so you can see who can reach production data through each identity.
- Assign explicit ownership for every identity type Tie each identity to a named business or technical owner and make offboarding, rotation, and access review dependent on that ownership record.
- Prioritise orphaned and over-privileged identities first Use visibility findings to remediate dormant accounts, excessive permissions, and unmanaged third-party access before you expand into deeper posture or detection work.
- Base incident triage on live identity state Make current identity inventory the starting point for response so investigators can immediately identify active identities, owners, and reachable systems in a compromised environment.
Key takeaways
- The article argues that identity visibility is the missing prerequisite for effective NHI governance, because control systems cannot manage identities they cannot enumerate.
- The strongest operational risk is stale or hidden access, including orphaned service accounts, over-privileged identities, and unmanaged AI agents.
- The practical priority is to build continuous discovery, ownership, and relationship mapping before relying on detection, response, or least-privilege enforcement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Orphaned identities remain active after projects or owners change. |
| NHI-05 — Overprivileged NHI | The article flags excessive access that goes unnoticed without visibility. | |
| NHI-09 — NHI Reuse | Shared or reused identities hide ownership and expand blast radius across environments. | |
| Recommendation — Track identity offboarding so dormant accounts and unused credentials are revoked before they become backdoors. Review identity permissions against actual usage and reduce access that exceeds business need. Separate reusable identities from system-specific access paths and retire shared credentials where possible. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The piece centres on inventory and lifecycle control of credentials and tokens. |
| Recommendation — Apply authenticator management to inventory, rotate, and revoke machine credentials on a tracked schedule. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about knowing who and what has access across environments. |
| Recommendation — Maintain current authorization records so access permissions and entitlements match actual identity state. | ||
Key terms
- Identity Visibility: Identity visibility is the ability to see which identities exist, what they can access, and how those access paths relate across systems. In NHI programmes, it means correlating service accounts, tokens, certificates, and agents into one operational view so governance decisions are based on evidence, not assumptions.
- Universal Identity Graph: A Universal Identity Graph is a relationship map that shows how identities connect to systems, permissions, and trust boundaries. It turns raw inventory into context, helping teams understand direct access, indirect reach, and the likely blast radius if an identity is compromised or misused.
- Orphaned Identity: An orphaned identity is a service account, token, or other machine credential that no longer has a clear owner, purpose, or retirement path. These identities create compliance and security risk because they are easy to forget, difficult to review, and often remain active long after they should have been removed.
- Ephemeral Credential Trust Debt: Ephemeral credential trust debt is the hidden risk that appears when short-lived tokens create a false sense of safety while permissions remain broad. The credential expires quickly, but the underlying blast radius stays large unless identity scope, revocation, and audit controls are also tightened.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org