Notifications
Clear all
Topic starter
25/06/2026 1:14 am
TL;DR: Identity is now a primary attack path, and the article argues that AI plus agentic capabilities are becoming central to IGA because compromised contractors, HR records, and non-human identities can be used to create legitimate-looking access, according to Omada Identity. The governance challenge is no longer just provisioning speed but whether access decisions, anomaly detection, and account lockdown can keep pace with modern identity abuse.
NHIMG editorial — based on content published by Omada Identity: Gartner Security and Risk Management Summit, Omada’s take on AI-driven IGA
Questions worth separating out
A: Security teams should treat HR and contractor records as security-sensitive inputs, not just administrative data.
Q: Why do non-human identities increase identity governance risk?
A: Non-human identities increase risk because they often hold elevated permissions, run at scale, and are not managed with the same lifecycle discipline as human accounts.
Q: What do teams get wrong about AI in IGA?
A: Teams often assume AI is only a productivity layer, when it may also influence or execute identity decisions.
Practitioner guidance
- Validate upstream identity sources Require stronger verification for HR, contractor, and third-party feeds before they can create or modify access.
- Tie every machine identity to an owner Map each non-human identity to a named business purpose, technical owner, and expiry condition.
- Control AI-assisted governance actions Separate AI recommendations from executable identity actions, then log who approved, what was changed, and how rollback would work.
What's in the full article
Omada Identity’s full blog covers the operational detail this post intentionally leaves for the source:
- The conversation with Craig Ramsay and Rod Simmons on AI-assisted IGA decision support and response.
- Omada’s explanation of how machine learning can cluster access patterns and generate policy recommendations.
- The examples of zero-day provisioning, entitlement bloat, and the data-quality issues that complicate IGA delivery.
- The product framing around simplified, scalable, and agile implementation methodology.
👉 Read Omada Identity’s take on AI-driven IGA and identity governance →
AI-driven IGA and agentic response: what IAM teams need now?
Explore further
25/06/2026 10:31 am
Identity governance is becoming a control plane for trust, not just access. When attackers can abuse HR records, contractor onboarding, and machine identities, IGA is no longer a back-office workflow layer. It becomes the system that decides whether an identity is real enough to receive power. That makes data integrity, exception handling, and source-of-truth validation central to governance. Practitioners need to treat identity input quality as a security control, not an administrative detail.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who should be accountable when agentic AI triggers an access lockdown?
A: Accountability should remain with the business and security owners who defined the policy and approved the automation. AI can detect anomalies and execute bounded actions, but it cannot own governance responsibility. Organisations need clear approval chains, audit logs, and rollback procedures for any machine-originated identity action.
👉 Read our full editorial: AI-driven IGA reshapes identity governance and attack response
