Topic starter
08/06/2026 4:56 pm
TL;DR: Astrix’s recognition in KuppingerCole’s CIEM Leadership Compass underscores a broader problem: traditional CIEM and IGA controls still leave service accounts, OAuth integrations, secrets, and other non-human identities only partially governed, especially across SaaS and cloud environments. That gap is now a core identity security issue, not a side case, according to KuppingerCole and Astrix Security.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “Astrix Named a KuppingerCole Rising Star”.
Key questions
Q: What breaks when non-human identities are not included in CIEM scope?
A: CIEM becomes an incomplete visibility layer rather than a governance control.
Q: Who should own governance for service accounts and OAuth integrations?
A: Ownership should sit with the business or platform team that depends on the access, with identity and security providing control requirements and review.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Define an NHI ownership model Assign a durable owner for every service account, OAuth grant, automation token, and secret so recertification and revocation have a clear accountability path.
- Inventory delegated third-party access Map all OAuth-connected applications and classify which ones have standing access to SaaS data, cloud APIs, or administrative actions.
- Separate NHI policy from human IGA Create governance rules for machine-to-machine access that cover discovery, intended use, monitoring, and offboarding instead of reusing human access review workflows.
Bottom line: Traditional CIEM still leaves important non-human identity paths under-governed, especially where cloud and SaaS access is delegated through service accounts and OAuth.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/06/2026 6:49 pm
CIEM exposes entitlement, but NHI governance decides whether that entitlement should still exist. KuppingerCole’s recognition of Astrix points to a structural limit in current identity programmes: visibility does not equal lifecycle control. Service accounts, OAuth integrations, and automation tokens can remain active long after the original business use has changed, and that leaves cloud identity governance with a blind spot that is operational, not theoretical. Practitioners should treat NHI governance as a separate control layer, not a feature of CIEM.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should IAM teams prioritise after discovering unmanaged NHI access?
A: Prioritise integrations and service identities with the widest blast radius first, especially OAuth connections and cloud service accounts that can reach multiple systems. Those are the identities most likely to turn visibility gaps into active exposure.
👉 Read our full editorial: Astrix and CIEM expose the NHI governance gap in cloud identity