Notifications
Clear all
Topic starter
25/06/2026 5:25 pm
TL;DR: Identity programmes are moving toward unified governance across workforce, machine, and AI-related access rather than treating them as separate control planes, according to Saviynt. Saviynt positions its AI-powered identity platform around managing human and non-human access across applications, data, and business processes, while claiming over 100 million identities protected, according to the company.
NHIMG editorial — based on content published by Saviynt: newsroom overview of recent identity platform developments
By the numbers:
- Over 100 million identities protected, and counting.
Questions worth separating out
Q: How should security teams govern human and non-human access in the same identity programme?
A: Start by separating the lifecycle rules, entitlement patterns, and review cadence for each identity class, then unify policy enforcement and reporting only where the controls truly align.
Q: Why does standing privilege create risk for both workforce and machine identities?
A: Standing privilege creates risk because access outlives the task, the operator, and sometimes the business need.
Q: How do just-in-time controls change privileged access management for machine identities?
A: JIT changes privileged access management by replacing persistent permissions with access that exists only for a defined task or session.
Practitioner guidance
- Audit identity classes separately before consolidating controls Inventory human users, service accounts, tokens, certificates, and AI-facing identities separately so that entitlement reviews do not collapse distinct lifecycle requirements into one model.
- Hunt for standing privilege in non-human workflows Trace long-lived credentials in automation, integrations, and platform-to-platform access paths, then remove any access that does not have a clear task boundary or expiry rule.
- Apply JIT to privileged access paths first Use just-in-time access where elevated permissions are intermittent, then extend the model to machine and operational identities that still rely on persistent access for convenience.
What's in the full article
Saviynt's full newsroom update covers the product and platform detail this post intentionally leaves for the source:
- The specific platform components Saviynt groups under identity security posture management, JIT access, and NHI support.
- The way Saviynt positions its AI-related capabilities alongside workforce and machine identity governance.
- The full list of solution areas and customer-facing use cases shown in the newsroom post.
- The vendor's own framing of how the platform supports compliance, operational efficiency, and access governance.
👉 Read Saviynt's newsroom update on identity platform developments →
Saviynt's identity platform and the convergence of NHI and IAM?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 6:04 pm
Identity platforms are being pulled toward a single control plane, but governance still fails at the actor boundary. The market message is clear: organisations want one place to govern human access, machine identities, and privileged entitlements. The problem is that convergence at the dashboard level does not erase the different lifecycle rules behind each actor type. Practitioners should treat unified identity as an aggregation layer, not proof that governance has been normalised.
A few things that frame the scale:
- From our research: The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- From our research: 88% of security professionals are concerned about secrets sprawl, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: What should organisations do before giving AI agents access to business systems?
A: Define the agent's tool scope, approval boundaries, logging requirements, and ownership before any production access is granted. AI agents should be treated as governed identities rather than ordinary automation because they can act independently within a session, and that makes accountability, containment, and revocation materially different from standard scripts.
👉 Read our full editorial: Saviynt's identity platform signals broader convergence in NHI and IAM
