Topic starter
15/08/2026 6:06 pm
TL;DR: 91% of active production identities are non-human and most security tools still stop at authentication, leaving post-login behavior largely invisible, according to ClearVector's Identity Intelligence Report. That gap matters because AI agents, service accounts, and third-party access now drive production activity, and the real risk is what an authenticated identity does next, not just whether it logged in.
Editorial analysis by NHI Mgmt Group, based on content published by ClearVector: “Identity behavior after authentication in production”.
By the numbers:
- 91% of active production identities are non-human in the ClearVector analysis.
- 87% are general non-human identities in the production identity breakdown.
- 4% are third-party identities in the production identity breakdown.
Key questions
Q: What fails when security tools stop at authentication for production identities?
A: The failure is post-login invisibility.
Q: Why do valid credentials still create so much risk in zero trust environments?
A: Because a credential can be valid and still be unsafe if it has more privilege than the current task requires.
Q: How do security teams know if workload identity monitoring is actually working?
A: Look for correlation between identity, workload, and runtime context.
Practitioner guidance
- Map production identities by behavior, not just ownership Build an inventory that separates human, NHI, third-party, and AI-mediated identities in production, then record what each one actually does after authentication.
- Baseline normal post-login activity per identity Define expected resources, role assumptions, timing patterns, and job sequences for each critical identity so deviations can be judged in context.
- Correlate runtime actions to the originating identity Add telemetry that ties cloud control plane actions, role assumption chains, and data access back to the authenticated identity at the moment the action occurs.
Bottom line: The main gap is not authentication failure but the lack of visibility into what identities do after they log in to production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:15 pm
Post-authentication behavior is now the primary identity security problem. Authentication still matters, but it no longer tells you whether an identity is safe once the session starts. The production environment is where service accounts, vendor access, and AI-mediated actions create risk that login telemetry cannot see. Practitioners should treat runtime behavior as the real governance surface.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between identity provider logs and runtime identity visibility?
A: Identity provider logs tell you that authentication succeeded and may show coarse session details. Runtime identity visibility ties the authenticated identity to the actual cloud, workload, or control-plane actions it performed after login, which is the level at which misuse, delegation drift, and unusual behavior become visible.
👉 Read our full editorial: Production identity behavior after authentication exposes the blind spot