Topic starter
24/06/2026 10:58 pm
TL;DR: Identity-related breaches are now a board-level identity security problem, according to CyberArk, citing 87% of organisations that have experienced at least two successful breaches and framing privileged controls, lifecycle governance and continuous discovery as the core response. The real issue is not adding more access tooling, but treating every identity type as part of one governance model.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “Your organization runs on identity — human, machine and AI.”.
By the numbers:
- 87% of organizations have experienced at least two successful identity-related breaches.
Key questions
Q: What do organisations get wrong when they treat human, machine, and AI identities the same?
A: They apply one policy model to identities with very different lifecycles, behaviours, and evidence requirements.
Q: Why do machine identities complicate identity governance more than human accounts?
A: Machine identities act continuously, at scale, and with delegated authority, so they cannot rely on manual review cycles or human pauses.
Q: What breaks when agent access reviews are designed like human access reviews?
A: Agent access reviews break when they assume a stable user, stable role, and stable review interval.
Practitioner guidance
- Map every identity class to one governance owner Assign explicit ownership for workforce accounts, service identities, developer access and AI-related identities so discovery, review and offboarding do not fall between teams.
- Unify access reviews across human and non-human identities Use a single recertification model that can handle employee access, service account entitlements and delegated machine access with the same control logic.
- Constrain privilege to task scope and runtime context Reduce standing access where possible and require privilege decisions to reflect the specific workflow, environment and identity type in use.
Bottom line: Identity security is now a governance issue across human, machine and AI identities, not just a control problem for employees.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:47 am
Identity security is now a cross-actor governance problem, not a single control domain. Human IAM, PAM and NHI governance are converging because privilege decisions now span employees, workloads and AI-enabled systems in one operating model. The old separation between user security and machine identity security leaves blind spots in discovery, review and offboarding. The practical conclusion is that identity governance must be designed around the full estate, not around organisational silos.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations converge human IAM, PAM, and NHI governance?
A: Yes, when the same programme needs to govern people, service accounts, and other machine identities under one ownership and certification model. Separate control planes create blind spots, duplicated policy logic, and inconsistent revocation. Convergence gives teams one place to apply lifecycle, privilege, and review discipline.
👉 Read our full editorial: Identity security now spans human, machine and AI identities