TL;DR: IGA coverage metrics can look stable while the governed estate shrinks relative to the real one, according to Klyro, because Shadow AI and machine identities expand the denominator faster than discovery and review cycles can update it. Coverage that cannot move downward is a historical report, not a control signal.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Klyro's blog post: Static IGA coverage ratios break when Shadow AI and non-human identities expand the real estate faster than discovery updates.
Why it matters: IAM and IGA teams need live denominators, because stale application counts hide ungoverned machine identities, abandoned integrations, and ownership gaps.
Context
Coverage only works when both parts of the ratio are current. In identity governance, the denominator is the live estate of applications and identities that exist, not the one captured in an old discovery run.
Shadow AI and machine identities make that denominator move continuously, which means a once-a-year inventory no longer describes the environment accurately. NHI lifecycle management becomes the practical lens for keeping the estate count tied to reality.
Key questions
Q: How should teams keep IGA coverage accurate as identities change?
A: Teams keep IGA coverage accurate by continuously discovering service accounts, API keys, tokens, certificates and workloads, then reconciling that live state against the identity catalogue. Continuous discovery detects new identities, orphaned accounts, expired secrets, scope drift and ownership gaps, so certifications, access reviews and rotation actions stay aligned with what actually exists.
Q: Why do service accounts and workloads become overprivileged over time?
A: They usually inherit access for a launch or integration and then keep it long after the original purpose changes. Without lifecycle enforcement, access is rarely revalidated against current use, so permissions drift upward while ownership becomes unclear. Over time, that turns ordinary operational identities into persistent security exposure.
Q: What is the difference between a static inventory and live discovery?
A: A static inventory is a point-in-time list of identities, accounts or assets captured manually or from a scheduled export. Live discovery is an ongoing mechanism that detects changes as they happen, such as new service accounts, tokens, certificates or workload identities, so ownership, access and expiry data stay current.
Q: How should teams assign ownership to non-human identities?
A: Teams should assign one accountable owner and one technical steward to every non-human identity, then require both to be recorded before production access is approved. Ownership should be tied to the identity lifecycle, including review, rotation, and retirement, so accountability survives staffing changes and application handoffs.
Technical breakdown
Why static denominators fail in identity governance
A coverage metric is only meaningful if the counted population changes with the environment. When discovery is treated as a one-time exercise, the numerator can improve while the denominator quietly expands through new integrations, abandoned credentials, and unmanaged service accounts. That creates a false sense of progress because the report describes only the governed subset, not the full estate. In practice, this is a measurement design problem, not a dashboard problem: the metric is asking a historical question about a live system. See the IAM and IGA Basics.
Practical implication: Treat the denominator as a continuously refreshed control input, not a fixed baseline.
How Shadow AI changes the identity estate
Shadow AI adds identities outside the normal request and approval path. Each tool, connector, or workflow can create credentials, tokens, and service accounts without passing through the same lifecycle checkpoints as human access. That matters because governance processes built around planned onboarding assume the new asset will be visible before it is active. Here, creation is often distributed across developers, business users, and automation layers, so the estate grows through side channels that traditional discovery misses. See the NHI Lifecycle Management Guide.
Practical implication: Extend inventory and governance scopes to capture identities created through tooling, automation, and self-service integrations.
Why non-human identities become exposed faster
Non-human identities are often long-lived, over-scoped, and weakly owned because teams optimise for keeping integrations working. Rotation can break production, broad permissions reduce setup friction, and no human owner is watching for abnormal use. The result is a population that is easy to forget and hard to retire. In identity terms, the problem is not that these credentials are exotic; it is that they sit outside the lifecycle discipline that would normally keep them current, scoped, and attributable. See the Joiner-Mover-Leaver (JML) Guide.
Practical implication: Build lifecycle controls around ownership, rotation, and offboarding for every machine identity that can reach production systems.
Threat narrative
Attacker objective: The attacker aims to reach production systems through machine identities that were never fully counted, scoped, or lifecycle-managed.
- Entry occurs through new Shadow AI integrations and other machine identities that are created outside the normal request workflow.
- Credential access is enabled because these non-human identities often carry long-lived secrets and broad permissions to keep integrations working.
- Impact follows when the governed count stays flat while ungoverned identities expand, leaving the organisation exposed to access that is neither reviewed nor retired.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Static coverage ratios create governance drift: A denominator set during an early discovery exercise stops representing the estate as soon as Shadow AI starts creating identities outside that process. The program may still govern the known population well, but the reported coverage no longer describes the real one. The practitioner consequence is simple: a coverage metric that cannot fall cannot be trusted as a control signal.
Enumeration is now the first governance control: Identity programs historically treated enumeration as a setup task and lifecycle as the operating task. That ordering breaks when the population changes continuously through API-driven integrations and delegated tooling. Coverage, ownership, and review all depend on knowing what exists right now, so the governance model has to start with discovery that is continuous rather than archival.
Non-human identities expose the hidden maintenance tax: The more expensive it is to onboard, correlate, and maintain an identity record, the faster the ungoverned tail grows. That is a structural governance problem, not an operational annoyance, because the tail is where stale ownership and broad access accumulate. Programs should treat onboarding friction as a risk multiplier, not a process detail.
Ownership is the control that turns counts into governance: A counted identity without a named accountable owner is only inventory. The article's core point is that coverage can look acceptable while accountability silently disappears, especially for machine identities created by teams rather than through central approval. The practitioner conclusion is that current coverage reports should be rejected wherever ownership cannot be assigned to a person with lifecycle responsibility.
Third-party access and non-human identity now overlap materially: The same accounts that sit outside joiner-mover-leaver workflows often serve both internal automation and external integrations. That overlap makes vendor, partner, and workflow-owned credentials part of the same governance problem, not separate buckets. The field should stop reporting them as isolated exceptions and start governing them as one population with different provenance.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Coverage metrics need lifecycle context: A governance number that ignores how identities are created and retired will keep overstating control maturity. For practitioners, the useful question is whether the metric can move with the estate, not whether it stayed comfortable at quarter-end.
Live denomination is now part of identity architecture: When AI tooling can create credentials faster than review cycles can absorb them, the inventory itself becomes a control surface. That pushes IGA teams to treat discovery, ownership, and offboarding as a single operating loop rather than separate projects.
Current-state reporting will separate governed from merely recorded: Programs that cannot tell the difference will keep counting identities that no longer have an owner, a purpose, or a valid credential lifecycle. The practical outcome is a shift from annual coverage reporting to continuous estate validation.
For practitioners
- Audit the denominator definition Rebuild coverage reporting so the application and identity denominator is refreshed from live sources, not a one-time discovery baseline.
- Count machine identities in the same estate Stop separating non-human identities into a side report and include service accounts, tokens, and integrations in the primary governed population.
- Assign a named owner to every credential Require a human accountable for the continued existence, scope, and rotation of each non-human identity before it is considered governed. See the Joiner-Mover-Leaver (JML) Guide.
- Measure coverage as a current condition Replace cumulative governance counts with a current-state metric that can fall when identities become stale, abandoned, or unowned.
Key takeaways
- Static IGA coverage can look healthy while the real identity estate expands beyond the denominator used in reporting.
- Shadow AI and machine identities change the math because new credentials can appear outside the normal request and discovery model.
- Live discovery, named ownership, and current-state reporting are the controls that turn coverage from a historical number into a governance signal.
Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Access Reviews and Certification Guide · Joiner-Mover-Leaver (JML) Guide · Identity Security Programme Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Stale identities and abandoned integrations are a lifecycle failure at the heart of this coverage problem. |
| NHI-05 — Overprivileged NHI | The post highlights broad access granted to keep integrations working, which is classic overprivilege. | |
| NHI-07 — Long-Lived Secrets | Long-lived credentials make the hidden tail of machine identities more exposed and harder to govern. | |
| Recommendation — Tie live coverage to offboarding so abandoned machine identities stop counting as governed assets. Review machine identity scopes and remove permissions that exceed the minimum integration need. Shorten secret lifetimes and rotate non-human credentials before they become permanent access paths. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventoried | The article argues that coverage fails when the asset and identity inventory is stale. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Coverage is only meaningful if permissions are governed for the identities included in the denominator. | |
| Recommendation — Maintain a continuously refreshed inventory of applications, identities, and integrations. Align entitlements to current business need and remove access that no longer maps to active use. | ||
| CIS Controls v8 | CIS-5 — Account Management | The denominator problem is an account lifecycle issue, especially for machine identities and abandoned access. |
| Recommendation — Track creation, ownership, and removal of every account type in a single account-management process. | ||
Key terms
- Coverage Metric: A coverage metric measures how much of the relevant application estate is actually being tested. In AppSec, it usually tracks reach across high-risk systems, onboarding speed, or scan frequency. The value is in showing whether the security control touches the real attack surface rather than a narrow sample.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org