Topic starter
25/06/2026 1:14 am
TL;DR: Identity is now a primary attack path, and the article argues that AI plus agentic capabilities are becoming central to IGA because compromised contractors, HR records, and non-human identities can be used to create legitimate-looking access, according to Omada Identity. The governance challenge is no longer just provisioning speed but whether access decisions, anomaly detection, and account lockdown can keep pace with modern identity abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Gartner Security and Risk Management Summit: Omada's Take on AI-Driven IGA”.
Key questions
A: Security teams should treat HR and contractor records as security-sensitive inputs, not just administrative data.
Q: Why does AI-driven containment matter for identity attacks?
A: Because the attack window often opens and closes inside routine access workflows.
Q: What breaks when non-human identities are not governed like human accounts?
A: Service accounts, API keys, tokens, and AI agents can retain access long after the original task ends because they do not naturally pass through joiner-mover-leaver processes.
Practitioner guidance
- Map identity source trust chains Identify which HR, contractor, and third-party systems can create or modify access-driving records, then classify them as security-relevant dependencies rather than administrative feeds.
- Define automated containment triggers Specify the anomaly conditions that can pause, lock, or suppress access without waiting for manual certification, especially for impossible logons and abnormal access inheritance.
- Inventory non-human identities by owner Create an authoritative register for applications, service accounts, API credentials, devices, and agents, including purpose, privilege scope, and revocation authority.
Bottom line: Identity governance is now part of the attack path, because compromised source systems can manufacture access that looks legitimate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:31 am
Identity governance is now an attack-surface control, not a back-office workflow. The article correctly treats contractors, HR records, and non-human identities as the places where adversaries can shape legitimate access before they ever touch the target application. That means the governance problem is upstream trust, not just downstream permissioning. Practitioners should read this as a shift from access administration to identity attack-path control.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should teams balance fast provisioning with stronger identity assurance?
A: By separating speed from trust. Fast access is only safe when the identity source is reliable, attributes are validated, and high-risk entitlements are gated by stronger controls. Teams should treat zero-day provisioning as a usability goal, not a security proof, unless the upstream evidence is trustworthy.
👉 Read our full editorial: AI-driven IGA reshapes identity governance and attack response