TL;DR: Nexis says KuppingerCole’s 2026 IGA Leadership Compass reflects a market shift toward lifecycle management, access intelligence, and governance of non-human identities such as service accounts and AI agents, which now outnumber humans in many enterprises by 25 to 50. IGA programmes that still treat NHIs as a side case are carrying a structural blind spot.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Nexis's blog post: IGA is shifting from human-centric governance toward lifecycle, access intelligence, and NHI governance across service accounts, bots, and AI agents.
Why it matters: It matters because IAM and IGA teams now have to govern machine and human identities through the same control plane, or they will miss orphaned access, role sprawl, and audit exposure.
👉 Read Nexis's analysis of IGA in 2026 and non-human identity governance
Context
Identity governance breaks down when programmes are built around human joiner-mover-leaver patterns but the environment also contains service accounts, bots, and AI agents. In that model, access decisions accumulate faster than review processes can keep up, and dormant privileges turn into hidden operational risk.
Nexis places that problem inside the IGA market in 2026, where access intelligence, lifecycle control, and deployment flexibility are being weighed together. The practical question is no longer whether NHIs belong in governance, but whether the governance model can actually track them with the same discipline as people.
Key questions
Q: How should organisations govern non-human identities inside IGA programmes?
A: Treat non-human identities as governed identities with owners, purposes, expiry paths, and review cycles. Service accounts, API keys, and tokens should enter the same lifecycle discipline as human accounts, with explicit onboarding, certification, rotation, and offboarding steps. If an identity cannot be assigned to a business owner, it should not remain privileged.
Q: Why do access reviews fail when entitlements grow faster than governance teams can validate them?
A: They fail because reviewers cannot reliably separate useful access from inherited or stale access when entitlement data is noisy. Without risk-ranked certification, business context, and ownership data, the process becomes a rubber stamp exercise. That leaves role sprawl, orphaned access, and SoD conflicts in place after the review cycle ends.
Q: What breaks when machine identities are tracked manually?
A: Manual tracking breaks when credential volume outpaces human oversight. Teams lose visibility into where certificates, keys, and secrets live, who owns them, and when they expire. That creates outages, audit gaps, and stale access paths that remain valid longer than intended. Central inventory and automated lifecycle control are the practical response.
Q: How do IGA controls need to adapt when environments span on-premises, containers, and SaaS?
A: They need to preserve policy, workflow, and evidence across different target systems without forcing a re-architecture for each deployment model. The practical test is whether provisioning and certification logic stays consistent when systems move between hosting patterns. If it does not, governance becomes fragmented and audit evidence loses continuity.
Technical breakdown
Why access intelligence has become a governance requirement
Access intelligence is the layer that turns raw entitlement data into decisions a reviewer can use. In IGA, that includes anomaly detection, entitlement recommendations, and risk-aware certification, which reduce the volume of low-value approvals and focus reviewers on unusual or high-impact access. The technical issue is not only scale. It is signal quality. If the platform cannot correlate account ownership, target-system context, and usage patterns, access reviews become a box-ticking exercise instead of a control.
Practical implication: prioritise review workflows that rank access by risk and business context rather than sending every entitlement through the same approval path.
How NHI governance differs from human identity governance
Non-human identity governance has a different lifecycle than human access. Service accounts, bots, and AI agents can be created outside HR-driven processes, reused across systems, and left behind when projects end. That makes ownership, inventory, and offboarding the core governance problems, not just authentication. When the same account is reused for multiple workloads or left active after the service changes, the control failure is not visibility alone. It is the absence of a lifecycle model that treats machine identities as governed assets.
Practical implication: extend identity lifecycle controls to machine identities so ownership, purpose, and revocation are tracked from creation to retirement.
Why deployment flexibility matters in regulated environments
IGA programmes in regulated sectors rarely operate in a pure cloud model. They often need to span on-premises, containerised, and SaaS environments while keeping consistent governance, auditability, and integration with older systems. The architectural challenge is therefore not one deployment style versus another. It is whether the governance layer can preserve policy, workflow, and evidence collection across heterogeneous target systems without re-architecting the whole programme every time infrastructure changes.
Practical implication: validate that your IGA architecture can maintain consistent certification and provisioning logic across mixed deployment models before expanding scope.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
IGA has moved from a compliance utility to an identity control plane. The article shows the category is now expected to connect lifecycle management, access governance, and access intelligence across fragmented enterprise environments. That means IGA is being judged less by whether it files certifications and more by whether it can reduce entitlement growth, support audit readiness, and preserve governance consistency across systems.
Non-human identity governance is no longer a side module. Service accounts, bots, and AI agents now sit inside the same governance problem as employees and contractors. A programme that only governs human identities is not partially complete. It is structurally blind to a growing share of entitlement risk, and practitioners should treat NHI coverage as core IGA scope, not an extension project.
Role sprawl is a governance outcome, not just a data hygiene problem. The article’s emphasis on years of unreviewed access decisions points to a deeper failure mode: identity programmes accumulate permissions faster than they can validate them. That makes access intelligence, business-readable governance, and clean entitlement data central to preventing invisible SoD conflicts and orphaned access.
Deployment flexibility has become a governance requirement, not a technical preference. Regulated sectors cannot assume a cloud-only IGA model will fit every environment. The market signal is that governance tooling must adapt to on-premises, container, and SaaS realities while preserving policy and evidence. Practitioners should test whether their governance model survives infrastructure heterogeneity before the next platform decision forces a redesign.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Identity governance now has to absorb machine identity reality: programmes built only around human access reviews will keep missing the accounts that are easiest to forget and hardest to retire. The next maturity step is to make lifecycle ownership and revocation part of the same governance motion used for people.
The market signal is not that IGA is becoming broader for its own sake. It is that governance has to move closer to the actual identity estate, where entitlement sprawl, service-account reuse, and cross-platform evidence collection determine whether the programme can survive scrutiny.
For practitioners
- Map NHI scope into your IGA programme Inventory service accounts, bots, and AI agent identities alongside human users so governance scope reflects the actual entitlement estate.
- Replace blanket certification with risk-ranked review queues Use access intelligence to prioritise high-risk entitlements, anomalous access, and SoD conflicts instead of sending every item through the same approval path.
- Assign lifecycle ownership for every machine identity Require a business owner, system owner, and revocation path for each non-human identity so orphaned accounts do not persist after the workload changes.
- Test governance across mixed deployment models Validate that provisioning, certification, and audit evidence work consistently across on-premises, containerised, and SaaS systems before expanding the programme.
Key takeaways
- IGA is no longer just a human identity compliance layer because machine identities now sit inside the same governance problem.
- The biggest operational risks in the article are stale entitlements, orphaned accounts, and review processes that cannot separate signal from noise.
- Programmes that extend lifecycle control, access intelligence, and evidence collection to NHIs are better positioned to reduce blind spots and audit friction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article stresses orphaned accounts and missing revocation paths for service accounts and bots. |
| NHI-05 — Overprivileged NHI | Role sprawl and unmanaged entitlements are central to the governance gap described in the article. | |
| Recommendation — Extend offboarding controls to non-human identities so retired workloads cannot keep access after purpose ends. Review NHI entitlements for excess privilege and remove access that is no longer tied to a current workload need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on how IGA manages entitlements, reviews, and authorization decisions across identities. |
| Recommendation — Apply PR.AA-05 to govern entitlements consistently across human and non-human identities. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account inventory, ownership, and lifecycle control are the operational core of the issue. |
| Recommendation — Use CIS-5 to inventory accounts, assign ownership, and retire identities that no longer have a business purpose. | ||
Key terms
- Access intelligence: Access intelligence is a runtime authorization approach that combines identity, context, and policy before granting or continuing access. It reduces the value of stolen credentials by requiring the request to still look legitimate at the moment of use, not just at the moment of approval.
- Non-Human Identity Governance: Non-human identity governance is the practice of managing, controlling, and auditing every machine identity across its full lifecycle. It covers service accounts, API keys, tokens, certificates, and AI agent credentials, ensuring each has a defined owner, scoped privilege, rotation schedule, and revocation path. Without governance, NHIs accumulate silently and become the primary attack surface in cloud and automated environments.
- Role Sprawl: Role sprawl is the gradual growth of overlapping or duplicated roles that are hard to review and even harder to retire. In SAP environments, it usually appears when context values are inconsistent, naming is uncontrolled, or teams build new roles instead of refining the governing model.
- Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
What's in the full article
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- How the KuppingerCole Leadership Compass evaluates access intelligence, workflow management, and API support across IGA vendors
- The specific ways Nexis describes its identity grids, AI co-pilot, and data quality routines in complex enterprise settings
- Practical context on how large regulated organisations layer governance over existing IAM and IGA investments
- The report framing behind deployment flexibility across on-premises, containerised, and SaaS environments
Deepen your knowledge
NHI governance, identity lifecycle management, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or IGA programme, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org