Topic starter
27/06/2026 1:02 pm
TL;DR: Clarity Security finds that conditional trust models built around periodic reviews and human-centric access workflows are no longer keeping pace with service accounts, API keys, OAuth tokens and AI agents, while up to 71% of breaches are now attributed to compromised credentials. Identity governance has moved from a review problem to a runtime control problem.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “What Is Adaptive Trust and Why Your Identity Program Probably Hasn’t Reached It Yet”.
By the numbers:
- Up to 71% of breaches are now attributed to compromised credentials and identity-based attacks, according to Clarity Security.
Key questions
Q: Where does conditional trust fail in modern identity governance?
A: Conditional trust fails when the environment changes faster than periodic reviews can detect and fix access drift.
Q: Why do compromised credentials create such a large breach risk in identity-led environments?
A: Because a stolen credential often appears legitimate to downstream systems, which means the attacker can blend into normal access flows.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Practitioner guidance
- Inventory every identity type in one governance model Map human users, contractors, service accounts, API keys, OAuth tokens and AI agents into a single authoritative inventory so access can be governed as one estate.
- Separate review evidence from remediation execution Use access reviews to confirm the state of access, then route identified gaps into the same workflow that can revoke, scope down or triage the risk.
- Define lifecycle ownership for non-human identities Assign explicit owners for creation, change, monitoring and retirement of service accounts and other machine identities because they will not appear in HR-driven governance flows.
Bottom line: Conditional trust no longer covers the identities and access patterns that dominate modern environments, especially non-human accounts and machine credentials.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- The full staged model of inherent trust, conditional trust and adaptive trust across identity types
- The maturity path from human-in-the-loop to human-in-the-middle to full autonomy for remediation
- The three structural blockers to continuous identity governance: tooling, governance scope and remediation disconnect
- The complete explanation of how just-in-time provisioning fits the adaptive trust model
👉 Read Clarity Security's analysis of adaptive trust and conditional identity governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:12 pm
Conditional trust is now a scope problem, not just a cadence problem. The model assumed the governed subject was mostly a person with a stable role, manager and employment relationship. That assumption fails when service accounts, API keys, OAuth tokens and AI agents dominate the access graph. The implication is that identity governance must be re-centred on the full identity estate, not on human review cycles alone.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams move from periodic access reviews to continuous governance?
A: Start by identifying the identity events that already occur in your environment, such as joiner, mover, leaver, entitlement change, and ownership change events. Then connect those signals to policy-driven workflows so routine decisions happen automatically and only risky exceptions reach human reviewers. The aim is fewer batch reviews and faster control action.
👉 Read our full editorial: Adaptive Trust exposes the limits of conditional identity governance