Notifications
Clear all
Topic starter
12/06/2026 12:18 am
TL;DR: Enterprises adopting AI must prove they can audit human and non-human identities, define roles and permissions, and support dynamic access controls before deployment, according to Gathid’s AI readiness article. The core issue is not AI performance but whether identity governance can keep pace with AI-enabled access sprawl and over-permissioning.
NHIMG editorial — based on content published by Gathid: AI Readiness Program for identity governance in the age of AI
By the numbers:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams audit identity readiness before deploying AI?
A: They should inventory every identity class that can reach production, including human users, service accounts, devices, and dormant accounts.
Q: Why do non-human identities make AI governance harder?
A: Non-human identities often carry excessive privilege, lack clear ownership, and are harder to recertify than human accounts.
Q: What breaks when access reviews are still mostly manual?
A: Manual reviews fail when identities change state, permissions spread across multiple systems, or access is granted too quickly for periodic certification to catch it.
Practitioner guidance
- Audit every identity class before AI rollout Inventory human users, service accounts, devices, and unknown identities that can access production systems.
- Rebuild access models around task-specific privilege Validate that roles and attributes actually constrain access to the systems and data an AI workflow touches.
- Move access reviews to context-aware decisioning Use current risk, location, and relationship data to drive review and authorisation decisions instead of relying only on periodic certification.
What's in the full article
Gathid's full article covers the operational detail this post intentionally leaves for the source:
- The five-question AI readiness questionnaire in full, including the exact audit and governance prompts.
- The identity graph and digital twin approach used to visualise relationships and conflict paths.
- The article's practical framing for SSO, MFA, and dynamic access review in AI deployments.
- The specific way Gathid maps AI-specific risk to identity policy decisions.
👉 Read Gathid's AI readiness article on identity governance for AI adoption →
AI-ready identity governance: what IAM teams need to fix first?
Explore further
12/06/2026 9:27 am
AI readiness is an identity governance problem before it is an AI problem. The article is right to place identity visibility, role design, and access control ahead of deployment ambition. Organisations that cannot inventory human and non-human identities cannot credibly claim AI readiness, because AI only accelerates the consequences of existing access disorder. The practitioner conclusion is straightforward: treat identity governance maturity as a prerequisite for AI adoption, not a follow-on workstream.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: How can organisations tell whether AI-ready identity controls are working?
A: Look for fewer unmanaged identities, lower privilege sprawl, and faster correction of access anomalies across human and non-human accounts. If the organisation can prove that access is current, scoped, and reviewable in one view, the identity programme is maturing in the right direction.
👉 Read our full editorial: AI-ready identity governance is becoming a prerequisite for secure adoption
