Topic starter
06/07/2026 9:43 am
TL;DR: Identity risk now spans human users, machines, non-human identities, and emerging AI agents, and its unified visibility approach is aimed at helping teams quantify and reduce attack surface, according to Axiad. The real issue is not staffing news but the widening gap between identity sprawl and governance models built for slower, human-paced access reviews.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Axiad Welcomes Jay Carpenter as Chief Revenue Officer”.
Key questions
Q: How should IAM teams govern human, non-human, and AI identities together?
A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct.
Q: Why do legacy IAM and PKI models fall short as identity estates expand?
A: They assume clearer ownership, slower lifecycle change, and more stable issuance patterns than modern identity estates provide.
Q: What signals show that identity visibility is not keeping up with risk?
A: The clearest signs are disconnected inventories, duplicate credential ownership, unclear revocation responsibility, and risk reports that do not change remediation priority.
Practitioner guidance
- Map the full identity estate Build a single inventory that includes human accounts, machines, service identities, certificates, and any AI-related access paths so governance starts from one view of exposure.
- Align credential management with identity risk Tie credential issuance, rotation, and revocation to risk scoring so privileged and high-value identities are handled before they accumulate blind spots.
- Close the visibility gap between IAM and PKI Document where authentication, certificate lifecycle, and identity verification sit in different tools or teams, then assign one accountable control owner for the overlap.
Bottom line: Identity risk is no longer confined to human users, because the article frames machines, NHI, and emerging AI agents as part of the same attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:59 am
Identity risk has become a programme-level governance issue, not a tooling feature. Axiad’s framing shows that enterprises no longer manage separate problems for users, machines, and AI-adjacent identities. They manage one expanding identity attack surface that cuts across IAM, credential management, and lifecycle control. That means identity governance has to be measured as an enterprise control plane, not as a collection of disconnected admin tasks.
A question worth separating out:
Q: How should organisations govern non-human identities alongside human IAM?
A: Treat non-human identities as a separate control population with their own inventory, ownership, lifecycle, and reporting. Service accounts, API keys, tokens, certificates, and AI agent credentials should not be folded into generic IAM metrics. That separation makes privilege review, rotation, and offboarding measurable and prevents hidden machine access from accumulating outside normal access governance.
👉 Read our full editorial: Axiad’s CRO hire signals a broader push into identity risk