Topic starter
07/09/2026 4:38 pm
TL;DR: As AI adoption reshapes access, resilience, and governance priorities, a survey of 1,100 IT and security professionals across eight countries examines how organizations are managing identity security, according to Semperis. The central issue is not AI novelty but whether identity controls can still govern systems, accounts, and lifecycle processes at the speed modern operations require.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Reports”.
Key questions
Q: What breaks when AI agent data access is not tied to identity governance?
A: What breaks is accountability.
Q: Why does AI make identity security a resilience issue?
A: AI raises the operational tempo around access decisions, which means identity failures can affect containment, recovery, and continuity, not just initial compromise.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Assess identity decision freshness Measure how long it takes for new access, changed access, and removed access to become visible in governance workflows.
- Map lifecycle ownership end to end Assign accountable owners for joiner, mover, and leaver processing across human users, service accounts, tokens, and workload credentials.
- Test identity controls under disruption Run recovery scenarios that force identity teams to revoke access, restore trusted state, and re-establish governance during an incident rather than after it.
Bottom line: Identity security in the AI era is shifting from a narrow access-control discussion to a broader governance and resilience problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/09/2026 4:38 pm
Identity security in the AI era is becoming a governance problem before it is a technology problem. Semperis' survey points to a familiar pattern: organisations can add more tools, but still struggle to keep identity decisions aligned with operational reality. The field should stop treating AI as a separate risk bucket and start treating it as a multiplier on existing IAM and resilience weaknesses. The practitioner conclusion is that governance quality now determines whether identity controls remain credible.
A question worth separating out:
Q: How should organisations govern non-human identities alongside employee access?
A: Organisations should govern NHIs with the same discipline used for human access, but with stronger lifecycle ownership and expiry controls. That means inventorying service accounts, tokens, certificates, and agents, assigning business ownership, and tying every entitlement to a documented purpose. Governance is incomplete if machine access cannot be approved, certified, and removed on demand.
👉 Read our full editorial: Identity security in the AI era needs stronger governance