Topic starter
24/06/2026 10:58 pm
TL;DR: Live governance visibility is still lagging the scale of non-human identities and agentic AI, Omada Identity found in research with 577 identity, IAM, and cybersecurity leaders. Identity programmes need continuous accountability metrics to show ownership, revocation, and privileged access rather than only activity.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Omada Releases State of Identity Governance 2026, Highlighting Gaps Between Identity Scale, Automation, and Executive Visibility”.
By the numbers:
- The report is based on primary research with 577 identity, access management, and cybersecurity leaders.
- Non-human identities now outnumber human identities in most organisations, often by factors of 50:1 or more.
Key questions
Q: Why do NHIs create more governance risk than human accounts?
A: NHIs usually run non-interactively, can be copied across systems, and often persist longer than the workload they serve.
A: Teams should measure operational outcomes, not just response time.
Q: What breaks when identity governance can only see provisioning, not live use?
A: Governance breaks at the point where approved access diverges from actual behaviour.
Practitioner guidance
- Measure leading identity risk indicators Track privileged access coverage, orphaned accounts, and time to revoke access alongside provisioning and audit metrics so governance reflects exposure, not just activity.
- Assign explicit ownership for every NHI class Create a named accountable owner for each service account, token set, and agentic workflow so renewal, approval, and removal decisions are not spread across multiple teams.
- Validate governance controls against agentic workflows Test whether unique identities, rotating credentials, and approval paths still hold when an AI-driven workflow moves across tools and identities during execution.
Bottom line: Non-human and agentic identities are scaling faster than the governance evidence most organisations use to judge their own control maturity.
Glossary terms: Identity Governance, Agentic AI Identity, Orphaned Account, Privilege coverage
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 16 hours ago by NHI Mgmt Group
25/06/2026 7:48 am
Identity governance is becoming a control-layer problem, not a reporting problem. The report shows that organisations can be confident in their programmes while still failing to track the metrics that actually reveal exposure. Provisioning speed and audit readiness matter, but they do not prove ownership, privilege scope, or revocation discipline. Practitioners should treat governance as continuous control validation, not activity summarisation.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when Zero Trust reporting cannot unify identity data?
A: Treat fragmented reporting as a control gap, not a dashboard issue. If identity state, access scope, and revocation timing cannot be reconciled across platforms, continuous verification is incomplete. The programme should not claim full governance coverage until those views are joined.
👉 Read our full editorial: Identity governance is lagging as agentic AI and NHI scale