TL;DR: Public sector cyberattacks now account for 34% of incidents in Spain, and 2025 activity rose 40% year over year, according to Soffid, as bot-driven scanning industrializes access exploitation and turns identity control into a service continuity issue. Compliance now depends on governance that can verify, recertify, and revoke without disrupting operations.
At a glance
What this is: This is a public-sector identity governance analysis showing that compliance pressure, bot-driven attack volume, and operational uptime are now the same problem space.
Why it matters: It matters because IAM and IGA teams in government, health, education, and defense must prove control over human and non-human access while keeping services available to citizens.
Context
Public sector identity governance is under pressure because attackers now use bot-driven scanning to find exposed access paths at scale. In this model, the weak point is rarely the institution itself, but the unmanaged identities that can open a path into the network.
For public administrations, the challenge is not only security but continuity. Access control, identity recertification, and auditability have to satisfy NIS2 and GDPR-style oversight while preserving service availability for citizens and employees.
The article is framed around public administration, health, education, and defense, where identity control spans large human populations and non-human entities. That makes lifecycle governance the control plane, not a back-office process.
Key questions
Q: Where does public-sector IAM fail when access reviews are still manual?
A: It fails when review cycles cannot keep pace with the number of identities, roles, and exceptions in use. Manual recertification leaves stale permissions in place and creates delay just when public organisations need to prove control. The result is a gap between policy intent and actual access governance.
Q: Why does identity sprawl increase risk in government environments?
A: Because more identities mean more permissions, more ownership ambiguity, and more chances for weak access paths to persist unnoticed. In public-sector systems, that sprawl affects both security and continuity, since every unmanaged account can become a route to sensitive data or service disruption.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use. If access reviews are always behind, permissions stay stale, and IT has to chase owners for answers, governance is operating more as paperwork than control.
Q: How should public-sector teams balance access control with service availability?
A: They should separate the decision to correct access from the ability to keep essential services running. The goal is to make revocation, recertification, and monitoring low-friction enough that governance improves uptime rather than interrupting it.
Technical breakdown
Why identity sprawl becomes the attack surface in public sector IAM
Public-sector environments combine large user populations, legacy platforms, and service access that must remain continuously available. That creates identity sprawl: many accounts, many roles, and many trust relationships that are difficult to verify consistently. When attackers use bots to scan for weak access paths, they are not exploiting a single system flaw so much as the organization’s inability to maintain a reliable inventory of who and what can reach which assets. In public administration, that includes employees, contractors, citizens, and non-human identities.
Practical implication: map every identity class to a governed owner, review cadence, and revocation path.
How automated recertification supports compliance without slowing operations
Recertification is only useful if it can be performed often enough to catch stale or excessive access, and only if the process does not create operational gridlock. The article points to automated identity recertification and periodic permission validation as the mechanism that lets public entities satisfy governance duties while avoiding manual bottlenecks. This matters because public institutions cannot afford access reviews that interrupt service delivery or stall approvals for routine changes. Automation changes the economics of compliance by making review continuous rather than episodic.
Practical implication: automate permission validation for high-risk roles and identities that touch citizen-facing services.
Why audit evidence is now part of identity control
In regulated public-sector environments, proving that controls existed and were executed matters almost as much as the control itself. The article highlights automatic report generation and incident logging as built-in evidence of compliance, which is important because oversight bodies need verifiable records of access decisions, identity changes, and incident response. This is not just documentation. It is a control feature that supports accountability when regulators ask who approved access, when it was reviewed, and what was revoked.
Practical implication: design identity workflows so recertification, revocation, and incident logging produce audit-ready evidence by default.
Threat narrative
Attacker objective: The attacker wants access to sensitive data and disruption of public services to increase leverage for extortion.
- Entry begins with bot-driven scanning that searches public-sector environments for exposed vulnerabilities and weak access paths.
- Escalation follows when unmanaged identities or weak identity governance allow access to sensitive systems and data.
- Impact is service disruption and sensitive-data exposure used as blackmail against public institutions and citizens.
Breaches seen in the wild
- Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance is now a service-continuity control in the public sector. The article shows that access control failures do not stay in the security domain when public services must remain available to citizens. In government, healthcare, education, and defense, identity sprawl becomes operational risk because every unmanaged account expands the chance of disruption. The practical conclusion is that identity governance is no longer a compliance overlay; it is part of core service resilience.
Public-sector compliance fails when identity review is manual, episodic, or disconnected from runtime access. NIS2-style governance expectations assume organisations can verify, revoke, and evidence access decisions at pace. That assumption breaks under large populations of human and non-human identities if recertification and permission validation are still handled as periodic paperwork. The implication is that governance programmes have to be built around continuous identity evidence, not annual clean-up exercises.
Automated recertification is the named concept this article makes unavoidable. The real issue is not simply access review, but the ability to keep permissions current while preserving operational uptime. That is where public-sector programmes tend to fail, because the cost of manual review is service delay and the cost of no review is exposure. Practitioners should treat identity lifecycle automation as a governance control, not an IT convenience.
Non-human entities widen the accountability problem in public administration. The article notes that public-sector identity estates include non-human entities alongside large human populations. That matters because ownership, review, and revocation become harder once access is delegated to service accounts or other machine identities that do not fit human-centric review rhythms. The conclusion is that public-sector IAM must govern actor type explicitly, or accountability will fragment across the delegation chain.
Regulatory pressure and operational pressure now point to the same control plane. The article connects ENS, NIS2, GDPR-style compliance, and operational continuity in one argument. That convergence means security, IAM, and audit teams can no longer optimise separately without creating gaps somewhere else. The practitioner takeaway is to align identity governance, incident logging, and service availability under one operating model.
What this signals
Automated identity governance is the practical bridge between compliance and continuity. Public administrations cannot rely on periodic clean-up cycles when identities change constantly and services must remain available. The programme shift is toward continuous review, continuous evidence, and continuous revocation authority.
Non-human identities should be treated as first-class public-sector accounts. Once machine or service identities sit inside citizen-facing environments, the old human-only governance model no longer matches reality. Teams need explicit ownership and lifecycle controls for every actor type, or audit and operational risk will keep rising together.
For practitioners
- Inventory all identity classes across public-sector systems Separate employees, contractors, citizens, and non-human entities so each class has an explicit owner, review cadence, and revocation path.
- Automate recertification for high-risk access Use periodic permission validation for privileged and citizen-facing accounts so stale access is removed without manual bottlenecks.
- Tie audit logging to identity lifecycle events Ensure access grants, permission changes, revocations, and incident responses generate records that can satisfy regulatory evidence requests.
- Separate operational uptime controls from approval workflow Design review and revocation paths so governance actions do not interrupt critical public services when access is being corrected.
Key takeaways
- Public-sector attacks now expose a governance problem as much as a security problem, because unmanaged identity access turns compliance failures into service disruption.
- The article links bot-driven scanning, identity sprawl, and regulatory pressure to the same control gap: access that cannot be verified, recertified, and revoked quickly enough.
- Public-sector IAM teams should automate lifecycle governance and audit evidence so compliance work strengthens uptime instead of competing with it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST CSF 2.0 sets the technical controls, and NIS2 and GDPR define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article stresses revocation and lifecycle control for public-sector identities. |
| NHI-05 — Overprivileged NHI | Public-sector access sprawl is the core governance risk described here. | |
| NHI-10 — Human Use of NHI | The article includes mixed human and non-human identity populations in public administration. | |
| Recommendation — Apply NHI-01 to ensure access is revoked cleanly when identities leave or change role. Review non-human accounts for excess privilege and reduce permissions to the minimum needed. Prevent humans from reusing non-human credentials for ad hoc access or administrative shortcuts. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post is fundamentally about governing permissions across public-sector systems. |
| GV.OV-01 — Oversight of the cybersecurity strategy and risk management | The article ties NIS2-style accountability and governance oversight to public-sector identity control. | |
| DE.CM-01 — Networks and physical environments are monitored to find potentially adverse events | Real-time monitoring and abnormal access detection are explicit controls in the article. | |
| Recommendation — Map identity reviews and revocation workflows to PR.AA-05 so permissions stay current. Use governance oversight to assign clear accountability for identity risk, compliance evidence, and remediation. Monitor access events continuously so abnormal identity behaviour is detected before service impact. | ||
| NIS2 | Art.21 — Cybersecurity risk-management measures | The article explicitly cites NIS2 as the main regulatory driver for risk analysis and response. |
| Recommendation — Align identity governance controls with NIS2 risk-management duties and incident-response expectations. | ||
| GDPR | Art.32 — Security of processing | The article frames public-sector identity governance in a GDPR-like compliance context. |
| Recommendation — Protect identity-related processing with controls that preserve confidentiality, integrity, and availability. | ||
Key terms
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Identity Recertification: Identity recertification is the periodic revalidation of whether access is still needed and still appropriate. For public-sector programmes, it is more than a compliance task, because it is one of the few ways to reduce privilege creep across both human and non-human identities.
- Non-Human Entity: A non-human entity is any machine or software identity that needs access to systems to perform work. This includes applications, automations, AI agents, services, and other workloads that authenticate with secrets rather than human credentials. These identities require tightly governed access because they operate at scale and speed.
- Audit Evidence: Audit evidence is the record set used to prove that access was authorised, limited, and revoked according to policy. For modern identity programmes, evidence must come from runtime logs, approval events, and lifecycle records rather than from manual spreadsheets assembled after the fact.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org