TL;DR: IT asset management software is increasingly being used as a control point for inventory, lifecycle, and compliance, but Zluri’s analysis shows the same asset sprawl that complicates hardware and software tracking also exposes identity relationships, dormant accounts, and shadow AI. That makes asset management a governance problem as much as an operations one.
At a glance
What this is: This overview positions IT asset management software as a control point for inventory, lifecycle tracking, and audit readiness while exposing hidden identity relationships across the environment.
Why it matters: It matters because IAM, IGA, and NHI programmes cannot treat assets as separate from access, since inventory blind spots often become entitlement blind spots.
Context
IT asset management software is supposed to provide a reliable inventory of hardware, software, and their lifecycle status. In practice, that inventory often becomes the place where access relationships are first visible, because assets, entitlements, and activity data are increasingly intertwined across SaaS, cloud, devices, and AI.
The governance gap is that ITAM has traditionally been framed as an operations and compliance function, while identity teams own access. Zluri’s article sits in the overlap between those disciplines: it shows that asset visibility can reveal dormant accounts, orphaned access, privilege creep, and shadow AI apps that standard asset registers do not capture cleanly.
Key questions
Q: What breaks when IT asset management does not include access governance?
A: The inventory may still look complete, but the organisation loses control over who can use each application, token, or device. That creates blind spots in offboarding, licence recovery, and review cycles, so unmanaged access persists even when the asset itself is known. Identity records and asset records have to be linked to make lifecycle control real.
Q: Why do stale asset records create identity risk in IT environments?
A: Because access decisions are often made once and forgotten while assets keep changing hands. When ownership, usage, or retirement is not reflected in identity records, permissions outlive the business need that justified them. That creates a persistent trust gap where dormant accounts and delegated access remain active after the asset has moved on.
Q: How do security teams know if ITAM is actually improving governance?
A: Look for evidence that discovered assets are mapped to owners, active entitlements, and closure actions. If audits reveal fewer unknown applications, fewer stale licences, and faster revocation when apps are retired, the programme is working. If the inventory grows but ownership and access freshness do not improve, governance is still superficial.
Q: Should organisations connect ITAM, IAM, and IGA workflows?
A: Yes. Asset management without identity workflows stops at description, while identity governance without asset context misses the operational trigger points where access should change. Joining the two helps teams tie ownership, lifecycle events, and entitlement reviews together so that access follows the real state of the asset, not a stale record.
Technical breakdown
Why ITAM software is becoming an identity control plane
Traditional ITAM records what exists, where it is, and who is meant to own it. Modern environments require more than that because asset records now intersect with identity data, entitlement data, and activity data across SaaS, cloud, devices, and AI. A single source of truth for assets becomes more useful when it can reveal who still has access after an asset changes hands, what identities are attached to shadow apps, and where lifecycle records no longer match reality. The technical shift is not that ITAM replaces IAM, but that the two domains now need shared telemetry to make inventory meaningful.
Practical implication: connect asset records to entitlement and activity data so inventory can surface access that no longer has a valid operational owner.
How asset lifecycle tracking exposes orphaned access and privilege creep
Asset lifecycle tracking only has governance value if it follows the asset from procurement through reassignment, retirement, and disposal. That lifecycle becomes an identity issue when access is not revoked at the same pace as the asset changes state. Orphaned access appears when an app, device, or workspace still carries privileges after ownership changes. Privilege creep appears when entitlements accumulate across multiple asset transitions without a reset point. In other words, the failure is not lack of inventory alone; it is the mismatch between asset state and access state.
Practical implication: tie provisioning and deprovisioning triggers to asset lifecycle events, not to periodic cleanup alone.
Shadow AI and unmanaged apps widen the identity surface
Shadow AI apps and unmanaged SaaS tools expand the identity surface because each one typically brings its own identities, tokens, and approval paths. ITAM tools that only catalog software names and versions miss the access layer embedded in these services. Once a tool is used by employees or integrated into a workflow, it becomes part of the identity perimeter whether or not it is formally approved. That makes discovery and classification essential, because unmanaged apps do not just create software sprawl. They create governance blind spots where access exists outside review and offboarding processes.
Practical implication: inventory shadow AI and SaaS alongside their attached identities, not as isolated application records.
Threat narrative
Attacker objective: The objective is to exploit stale or invisible identity relationships attached to assets in order to keep unauthorized access alive across the environment.
- Entry begins when cloud, SaaS, device, or AI assets are added without identity-level ownership or lifecycle linkage, leaving access attached to the wrong records.
- Credential or entitlement exposure follows when dormant accounts, orphaned access, or overextended privileges persist after reassignment or offboarding.
- Escalation occurs when those stale relationships let users or workloads move across applications with more access than their current role justifies.
- Impact is broader operational and governance exposure, including audit gaps, hidden access paths, and shadow services that remain active without clear accountability.
Breaches seen in the wild
- SolarWinds supply chain compromise: A backdoored Orion build reached 18,000 customers; attackers then forged SAML tokens and hijacked app service principals.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
ITAM is becoming identity infrastructure, not just inventory tooling. Once asset records are linked to entitlements and activity, the control no longer stops at knowing what exists. It becomes a way to detect whether access still matches asset ownership, which is the real governance question for modern environments. Practitioners should treat asset data as part of the identity system, not a separate operations ledger.
Identity surface gap: The article surfaces a useful concept for the field because many organisations still measure asset completeness without measuring identity completeness. A clean asset list can still hide dormant accounts, orphaned access, and shadow AI usage if identity and activity are not joined to the inventory. The practical conclusion is that visibility only becomes governance when it can answer who can still act through the asset.
Lifecycle drift is the failure mode that matters most. Asset acquisition, reassignment, and retirement often move faster than access recertification or entitlement cleanup. That means the governance failure is not merely incomplete inventory but access that outlives the asset state that justified it. For identity teams, the lesson is to treat lifecycle drift as a first-class control gap rather than a reporting issue.
Cross-domain governance is now unavoidable. ITAM teams, IAM teams, and security operations are looking at different slices of the same risk surface. When asset visibility reveals access relationships, the boundary between configuration management and identity governance collapses. Practitioners should expect future control design to merge inventory, entitlement, and activity telemetry into a single governance view.
SolarWinds remains the right cautionary pattern for this category. The lesson is not limited to software supply chain compromise; it is that trusted asset relationships can become hidden identity pathways. When organisations do not govern the access attached to software relationships, they preserve the conditions for quiet persistence. The field should read ITAM through an identity risk lens, not only a compliance lens.
What this signals
Identity surface gap: Asset visibility becomes materially more useful when it reveals the identities, tokens, and approvals attached to the asset rather than only the asset itself. That is where ITAM stops being a catalogue and starts becoming a governance signal.
Teams should expect asset management and identity governance to converge around lifecycle events. Reassignment, retirement, and disposal are no longer operational milestones alone; they are moments when access state should be verified against asset state.
Shadow AI is the clearest example of why inventory and identity can no longer be separated. If an organisation can list the application but not the identity relationships behind it, it does not yet have control of the surface it is trying to govern.
For practitioners
- Map asset records to identity ownership Join CMDB or ITAM records to app owners, service owners, and identity owners so every asset has an accountable access steward.
- Trigger access review on asset state changes Require recertification or entitlement review when assets are reassigned, retired, or moved between teams, rather than waiting for quarterly audits.
- Inventory shadow AI with attached identities Classify unsanctioned AI apps, SaaS tools, and embedded automations together with their tokens, accounts, and approvers.
- Remove orphaned access at disposal Tie offboarding and device disposal workflows to revocation of any linked accounts, API keys, or delegated permissions.
- Use audit readiness as a governance test Validate whether asset reports can prove current access, not just existence, because audit-ready inventory without identity context still leaves hidden exposure.
Key takeaways
- IT asset management software now matters to identity governance because asset records often expose who still has access after ownership changes.
- The core failure mode is lifecycle drift, where access outlives the asset state that originally justified it.
- Teams should connect asset, entitlement, and activity data so inventory can drive revocation, recertification, and offboarding decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Asset retirement and reassignment can leave access behind if offboarding is not tied to lifecycle. |
| NHI-05 — Overprivileged NHI | The article highlights hidden access relationships and privilege creep across assets. | |
| Recommendation — Tie asset retirement to NHI offboarding so access is revoked when the asset is no longer in service. Review asset-linked identities for excess privilege and reduce entitlements to the minimum needed. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Asset visibility only becomes governance when permissions are aligned to current ownership and use. |
| Recommendation — Align entitlements to current asset ownership and remove access that no longer matches business need. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Persistent asset-linked access can be abused for credential use and movement across systems. |
| Recommendation — Map stale asset-linked access to credential access and lateral movement paths in detection and review. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centers on account and entitlement cleanup tied to asset lifecycle events. |
| Recommendation — Use account management controls to remove orphaned accounts when assets are reassigned or retired. | ||
Key terms
- Identity Surface: The identity surface is the full set of credentials, tokens, tool permissions, and delegated identities an AI agent can use during execution. It matters because agents often do not operate through a single account, and partial visibility into that surface creates false confidence about control coverage.
- Orphaned Access: Orphaned access is credentialed access that still works even though no clear business owner can justify or manage it. It usually appears after system changes, reorganisations, or integrations, and it is especially dangerous because it can remain active long after the original purpose has disappeared.
- Lifecycle Drift: Lifecycle drift is the gap between the intended state of an identity and the access that remains active in systems after the business context changes. It often appears as delayed revocation, stale privileges, or unowned credentials, and it is a practical indicator that governance is out of sync.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org