Topic starter
24/06/2026 10:31 pm
TL;DR: Non-human identities now outnumber human identities by 25x to 50x in modern enterprises, according to SailPoint. Identity governance has to track machine and agent lifecycles continuously, or privilege reviews arrive after access has already shifted.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “The next chapter of adaptive identity: From vision to market-leading reality”.
Key questions
Q: Why do standing privileges make machine identities harder to secure?
A: Standing privileges extend the period in which a compromised secret can be abused, which enlarges the blast radius of a single exposure.
Q: How can security teams tell whether adaptive identity is actually working?
A: Look for shorter privilege duration, fewer standing entitlements, faster discovery of privileged paths, and reduced dependence on quarterly certification as the primary control.
Q: What breaks when organisations rely only on periodic access reviews?
A: Periodic reviews miss access that changes between certification windows, which leaves risk hidden until after the fact.
Practitioner guidance
- Define continuous governance thresholds Move high-risk AI agents and machine accounts out of periodic review queues and into continuously monitored governance thresholds based on privilege, environment, and task context.
- Enforce JIT for non-human access Replace standing access with task-scoped entitlement issuance for non-human identities, including automatic expiry and explicit re-approval for reuse.
- Classify indirect privilege paths Use identity graph analysis to identify hidden entitlement chains, inherited access, and over-privileged pathways that are not visible in direct assignment lists.
Bottom line: Legacy governance is out of step with the pace of AI agents and machine identities, which can change faster than periodic review cycles can observe.
Glossary terms: Adaptive Identity, Just-in-Time Access Request, Identity Graph, Standing Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:14 am
Continuous governance is becoming the baseline for non-human identity control. Periodic access review was designed for slower, human-paced identity change, not for machine identities and AI agents that can be created and retired within minutes. That assumption is breaking in cloud-first environments where privilege can be granted and used before a review cycle even begins. The implication is that governance must move closer to issuance time and runtime state, not rely on retrospective certification.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat AI SOC agents like governed identities?
A: Yes, because the practical risk is delegated access, not just model output. If an AI agent can read evidence, prepare actions, or trigger connected tools, it needs scoped permissions, defined task boundaries, and revocation when the workflow ends. That is the identity control model SOC teams already use for other non-human actors.
👉 Read our full editorial: Adaptive identity and AI agents are reshaping identity governance