TL;DR: Identity governance has moved from compliance workflow to enterprise security control, with Linx Security arguing the shift as it raised $50 million in Series B funding, citing millions of governed identities, 80-to-1 identity ratios, and nearly 90% of security incidents tied to identity failures. The funding underscores how rapidly IAM, NHI, and agent governance are converging into one operating problem.
At a glance
What this is: This is a funding announcement that frames identity governance as a security control, arguing that identity sprawl across humans, machines and AI agents has outgrown periodic review models.
Why it matters: It matters because IAM, NHI and agent governance teams now have to treat identity visibility and enforcement as operational security, not just compliance administration.
Context
Identity governance is the set of controls used to understand, approve, review and remove access across users, service accounts, workloads and other identities. In this article, Linx Security argues that the model built around periodic certifications is no longer sufficient once identity populations become large, dynamic and mixed across human and non-human actors.
The governance gap is not just volume. It is the mismatch between static review cycles and environments where access changes continuously, often faster than a manual control can observe. The article positions identity governance as part of the security operating model for human IAM, NHI governance and AI agent oversight, not a back-office workflow.
Key questions
Q: Why do periodic access reviews fail when identity estates include NHIs and AI agents?
A: Periodic reviews assume access remains stable long enough to certify it. In mixed identity estates, service accounts, tokens and agent credentials can change faster than the review cycle, so the control confirms history instead of current risk. Continuous state monitoring is needed when privilege moves faster than governance cadence.
Q: When should organisations prioritise runtime governance over recertification?
A: Organisations should prioritise runtime governance when access can be created, used, and retired within a single task or session. In that model, recertification becomes too slow to prevent misuse or excess privilege. Runtime controls matter most when the business depends on autonomous execution, dynamic tokens, or machine-led decision loops.
Q: What breaks when identity governance is built only for human users?
A: Access review, joiner-mover-leaver processes, and periodic certification break down when the identity is a service account or autonomous agent. Those controls assume a visible human lifecycle and a stable review window. Machine identities and agents can outlive those assumptions, leaving access active after the programme believes it has been governed.
Q: How should teams govern AI agents that act inside customer accounts?
A: Treat them as delegated non-human identities, not as ordinary customer sessions. Governance should require explicit consent, narrow authorization scope, token binding, and a complete audit record tying each action back to the human principal that approved it.
Technical breakdown
Why periodic access reviews break at identity scale
Periodic access reviews assume identities and privileges remain stable long enough to be sampled, certified and remediated. That assumption weakens when organisations operate millions of identities across employees, services, tokens and AI agents, because the control sees snapshots rather than live state. A review may confirm yesterday’s access while the real risk has already shifted. The technical issue is not only scale but churn: identities appear, inherit privilege, change context and disappear faster than governance cycles can keep up. When that happens, manual recertification becomes evidence of process completion rather than evidence of control.
Practical implication: Move governance from snapshot review to continuous identity state monitoring and event-driven remediation.
How identity governance becomes security infrastructure
Identity governance becomes security infrastructure when it is used to enforce who or what may access systems at runtime, not just to document entitlements. In that model, governance systems map identities continuously, detect meaningful changes, and trigger action while the access decision is still operationally relevant. This matters for NHI because service accounts, API keys, certificates and agent credentials often behave like standing infrastructure, even though the business treats them as administrative artefacts. The security function is to collapse the gap between discovery and enforcement so the access state is current enough to trust.
Practical implication: Treat identity governance outputs as enforcement inputs for access control, risk response and offboarding workflows.
Agent governance changes the meaning of privileged identity
Autonomous or semi-autonomous AI agents blur the line between a governed identity and an acting system. Traditional identity tooling assumes the subject is either a person or a static non-human workload, but agents can generate activity, request tools and trigger follow-on actions at runtime. That means privilege is no longer only about what was granted; it is also about how a system can combine permissions while operating. For governance, the important question is whether the control plane can observe behaviour quickly enough to distinguish intended delegation from scope drift. Without that, privilege reviews become too late to contain agentic misuse.
Practical implication: Classify agent identities separately and govern them with runtime monitoring plus explicit scope boundaries.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance is now a security control, not a reporting layer. The article reflects a broader shift in which identity visibility, entitlement review and remediation sit inside the security operating model. That is true for human IAM, but it becomes more urgent as NHI and agent populations multiply faster than manual governance can process them. Practitioners should stop treating governance as downstream evidence collection and start treating it as a live control surface.
Continuous enforcement is the right mental model for mixed identity estates. When humans, workloads and agents all operate inside the same enterprise boundary, one governance cadence cannot serve all three equally well. Static review cycles can still support audit needs, but they do not describe the current state of risk. The discipline now is to separate reporting cadence from enforcement cadence so high-risk identity changes are acted on as they happen.
Identity blast radius is the concept this market is converging on. The article’s core message is that the security question is no longer how many identities exist, but how much damage any one identity can cause when controls are stale. That applies across human users, service accounts and AI agents, but the consequence is clearest in NHI estates where credentials are durable and widely reused. Practitioners need to think in terms of blast radius, not just access volume.
Agent governance sits at the frontier of identity programme design. The appearance of AI agents inside governance scope changes what counts as a managed identity. Agents can act, chain actions and generate operational risk in ways that standard recertification processes were never designed to catch. The implication for identity leaders is that programme boundaries are expanding from people and service accounts to systems that can initiate change on their own. That forces tighter control over runtime authorisation and delegated access.
What this signals
Identity governance now has to absorb runtime behaviour, not just entitlement lists. As identity estates expand across users, workloads and agents, the useful question becomes whether the control can keep pace with change. If governance only proves that a review happened, it no longer proves that access was safe.
Identity blast radius is the operational metric that matters most. The practical risk is not simply how many identities exist, but how much access any one identity can accumulate before the control plane reacts. That is why continuous discovery and rapid containment are becoming central to programme design.
Agent governance changes the baseline for privileged access management. When an identity can initiate actions without waiting for a human operator, privilege has to be judged in motion. That pushes identity teams toward runtime enforcement and away from periodic certification as the primary safety net.
For practitioners
- Map all identity types into one governed inventory Build a single inventory that covers employees, service accounts, API keys, certificates and AI agents, then tag each identity by owner, purpose, privilege and review cadence.
- Replace quarterly reviews for high-risk identities Use event-driven reviews for identities that can create material change quickly, especially privileged NHIs and agent credentials that may move faster than a scheduled certification cycle.
- Define runtime controls for agent identities Set explicit behavioural boundaries for agents, including approved tools, delegated scope and escalation triggers, so governance can intervene while the session is still active.
- Measure governance by time to containment Track how quickly risky access is discovered, triaged and removed after a change in context, rather than only measuring review completion rates.
- Align offboarding to the identity type Differentiate human leaver processes from service account deprovisioning and agent retirement, because the failure modes and handoffs are not the same.
Key takeaways
- Identity governance is shifting from an administrative process to a live security control because modern identity estates change too quickly for periodic reviews alone.
- The article ties the problem to scale, with millions of governed identities and identity populations that now extend across humans, machines and agents.
- Practitioners should respond by moving toward continuous identity monitoring, faster containment and lifecycle controls that differ by actor type.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on identity sprawl and excessive access across machine and agent identities. |
| NHI-01 — Improper Offboarding | The post stresses lifecycle governance across humans, machines and agents as identities come and go. | |
| Recommendation — Review NHI privilege scope continuously and reduce standing access that outlives its operational need. Apply lifecycle controls to remove identities and revoke access when their business purpose ends. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article explicitly discusses AI agents expanding the identity and privilege problem space. |
| Recommendation — Constrain agent privileges at runtime and monitor for scope drift across delegated actions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Continuous entitlement control is central to the article’s governance argument. |
| Recommendation — Use entitlement governance to keep authorizations current across human and non-human identities. | ||
| CIS Controls v8 | CIS-5 — Account Management | The funding story is fundamentally about managing large, changing identity populations. |
| Recommendation — Maintain an accurate account inventory and revoke dormant or unnecessary access paths promptly. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Agent Governance: Agent governance is the set of policies, controls, and evidence required to manage autonomous software as a non-human identity. It covers consent, tool access, lifecycle review, audit logging, and revocation so that an agent remains bounded as its workflows change.
- Continuous Identity Risk Monitoring: Continuous identity risk monitoring is the ongoing observation of identity activity to detect anomalies, policy violations, and emerging access issues. In SaaS environments, it helps teams find unsafe account behavior sooner, improve response times, and keep access aligned with current business needs and security rules.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 5, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org