Topic starter
30/07/2026 10:48 pm
TL;DR: Forrester’s Q4 2025 Workforce Identity Security Platforms Landscape frames NHIs, service accounts, workloads, APIs, and AI agents as a primary market challenge, while positioning workforce identity platforms around governance, posture, and lifecycle controls across humans and machines, according to Linx Security. Traditional IAM assumptions are no longer sufficient when identity sprawl and agentic access become the norm.
Editorial analysis by NHI Mgmt Group, based on content published by Linx Security: “Linx Listed In Forrester’s Workforce Identity Security Platforms Landscape”.
Key questions
Q: How should security teams govern AI agents that use existing NHI credentials?
A: Treat every AI agent as a non-human identity with its own owner, scope, and expiry.
Q: How should security teams prevent orphan accounts in mixed human and machine identity environments?
A: Security teams should connect identity lifecycle events to authoritative source systems so joiner, mover, and leaver changes trigger timely deprovisioning.
Q: What breaks when lifecycle governance does not cover non-human identities?
A: Compliance reporting becomes incomplete because the organisation can no longer prove who or what had access, for how long, and whether that access was removed on time.
Practitioner guidance
- Treat non-human identities as governed workforce identities Inventory service accounts, workloads, APIs, and AI agents in the same governance model you use for people, with clear ownership and lifecycle status.
- Redesign access reviews for decision quality Add contextual entitlement data, business ownership, and usage evidence so reviewers can assess whether access still makes sense.
- Map identity relationships as a graph Connect identities, permissions, apps, and data paths so excessive access and high-risk combinations can be prioritised for remediation.
Bottom line: Forrester’s landscape reflects a broader shift in which workforce identity now includes machines and AI agents, not only employees.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:54 pm
Workforce identity security is becoming a governance model for mixed identity estates, not a human IAM extension. Forrester’s framing matters because it treats NHIs, machine access, and AI agents as part of the same operational identity surface as employees. That is the real category shift: access control now has to handle identities that never log in like people but still create business risk. The implication is that identity strategy, not just tooling, has to assume mixed estates as the default.
A question worth separating out:
Q: How do organisations know if identity security posture management is working?
A: It is working if posture findings lead to measurable entitlement reduction, fewer stale accounts, and shorter remediation cycles. Dashboards alone are not enough. The signal is whether over-scoped access is being removed, reviewed, and tied back to accountable owners before it becomes an audit or breach issue.
👉 Read our full editorial: Forrester’s workforce identity landscape spotlights NHI and AI agent risk