Notifications
Clear all
Topic starter
15/08/2026 6:10 pm
TL;DR: Identity is now the control plane for cloud, SaaS, and AI systems, but most organisations still cannot inventory or govern the service accounts, API keys, workload identities, and AI agents expanding faster than human users, according to Britive. The runtime control gap is now the real security problem: if access cannot be enforced, observed, and revoked at task speed, least privilege remains theoretical.
NHIMG editorial — based on content published by Britive: 2026 Security Predictions: Identity as the Control Plane for Cloud & AI
By the numbers:
- Studies across 2025 consistently show that NHIs now outnumber humans by factors ranging from 40:1 to over 100:1, depending on the industry.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should security teams govern AI models that can call tools and access data?
A: Security teams should govern AI models as non-human identities with named owners, limited scope, short-lived credentials, and continuous authorization.
Q: Why do cloud environments make zero trust harder to enforce?
A: Cloud environments distribute data, automate access, and reuse credentials across tools and services, which weakens perimeter-based assumptions.
Q: What breaks when organisations rely only on periodic access reviews?
A: Periodic reviews miss access that changes between certification windows, which leaves risk hidden until after the fact.
Practitioner guidance
- Inventory every non-human identity continuously Build a live inventory of service accounts, API keys, workload identities, pipeline tokens, and AI agents across cloud and SaaS platforms.
- Enforce task-scoped runtime authorisation Replace broad standing permissions with time-bound access issued at the moment of execution and removed automatically when the task ends.
- Measure privilege by expiry, not by assignment Track how often high-risk access is created, how quickly it is revoked, and how much unused privilege remains after workflows complete.
What's in the full article
Britive's full blog post covers the operational detail this post intentionally leaves for the source:
- Examples of runtime authorisation patterns for cloud and AI workflows that go beyond standing roles.
- Practical breakdowns of how teams can measure zero standing privilege across humans, NHIs, and agents.
- The article's own view of how PAM, CIEM, ITDR, and AI governance converge in real environments.
- The specific operational implications of treating agents as first-class identities with lifecycle controls.
👉 Read Britive's 2026 predictions on identity as the cloud and AI control plane →
Identity as the cloud and AI control plane: are controls keeping up?
Explore further
15/08/2026 6:18 pm
Identity as the control plane only works when runtime enforcement replaces static trust: Identity governance built for periodic reviews assumes access can be examined after it exists. Cloud and AI workflows now execute too quickly and across too many systems for that assumption to hold. The practical conclusion is that access control must be enforced at the moment of action, not after entitlement assignment.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: Identity as the cloud and AI control plane in 2026
