Topic starter
24/06/2026 10:58 pm
TL;DR: Non-human identities often outnumber human identities by 50:1 or more while 85% of organisations are already using or piloting agentic AI, according to Omada Identity’s 2026 State of Identity Governance report based on research with 577 identity, IAM, and cybersecurity leaders. Governance now has to catch up to machine-scale identity exposure, not just measure operational throughput.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Omada Releases State of Identity Governance 2026, Highlighting Gaps Between Identity Scale, Automation, and Executive Visibility”.
By the numbers:
- The report is based on primary research with 577 identity, access management, and cybersecurity leaders.
- Non-human identities now outnumber human identities in most organisations, often by factors of 50:1 or more.
Key questions
Q: What breaks when identity governance can only see provisioning, not live use?
A: Governance breaks at the point where approved access diverges from actual behaviour.
Q: Why do NHIs create more governance risk than human accounts?
A: NHIs usually run non-interactively, can be copied across systems, and often persist longer than the workload they serve.
A: Teams should measure operational outcomes, not just response time.
Practitioner guidance
- Measure leading identity risk indicators Track privileged access coverage, orphaned accounts, and time to revoke access alongside provisioning and audit metrics so governance reflects exposure, not just activity.
- Assign explicit ownership for every NHI class Create a named accountable owner for each service account, token set, and agentic workflow so renewal, approval, and removal decisions are not spread across multiple teams.
- Validate governance controls against agentic workflows Test whether unique identities, rotating credentials, and approval paths still hold when an AI-driven workflow moves across tools and identities during execution.
Bottom line: Non-human and agentic identities are scaling faster than the governance evidence most organisations use to judge their own control maturity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:48 am
Identity governance is becoming a control-layer problem, not a reporting problem. The report shows that organisations can be confident in their programmes while still failing to track the metrics that actually reveal exposure. Provisioning speed and audit readiness matter, but they do not prove ownership, privilege scope, or revocation discipline. Practitioners should treat governance as continuous control validation, not activity summarisation.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when Zero Trust reporting cannot unify identity data?
A: Treat fragmented reporting as a control gap, not a dashboard issue. If identity state, access scope, and revocation timing cannot be reconciled across platforms, continuous verification is incomplete. The programme should not claim full governance coverage until those views are joined.
👉 Read our full editorial: Identity governance is lagging as agentic AI and NHI scale