Notifications
Clear all
Topic starter
10/07/2026 9:14 pm
TL;DR: IAM trends for 2026 centre on non-human identity sprawl, AI-assisted detection, and simpler architectures, with Soffid citing 80 NHIs per human identity, 99% excessive privilege, and credential compromise in under 1 minute. The governance shift is from fragmented controls to continuous discovery, lifecycle enforcement, and measurable identity resilience.
NHIMG editorial — based on content published by Soffid: IAM trends 2026: what CISOs need to prepare for
By the numbers:
- 80 non-human identities for every human identity
- 99% of accounts with excessive privileges
- 66% of credentials compromised in less than 1 minute
Questions worth separating out
Q: How should security teams govern non-human identities across cloud and CI/CD environments?
A: They should treat non-human identities as first-class assets with continuous discovery, ownership, expiry, and revocation tied to platform events.
Q: Why do excessive privileges create so much IAM risk?
A: Excessive privileges expand the blast radius of any compromised account, whether human or non-human.
Q: What do organisations get wrong about AI in IAM?
A: They often expect AI to replace governance when its real value is better detection and faster triage.
Practitioner guidance
- Implement continuous NHI discovery Tie discovery to cloud accounts, CI/CD, application registries, and secret stores so new service accounts and tokens are visible before they become orphaned access paths.
- Automate lifecycle enforcement for NHIs Apply expiration, immediate offboarding, and credential rotation to service accounts and API keys whenever an application is decommissioned or ownership changes.
- Measure excessive privilege at identity scale Track the percentage of accounts with elevated permissions, then prioritise the identities with the widest blast radius and the weakest ownership evidence.
What's in the full article
Soffid's full article covers the operational detail this post intentionally leaves for the source:
- A practitioner checklist for NHI inventory, offboarding, and credential rotation across cloud and application estates.
- The article's own maturity questions for assessing whether your IAM stack can detect orphaned accounts and exposed secrets.
- A discussion of how AI can support adaptive IAM decisions without removing governance accountability.
- The specific 2026 trend framing Soffid uses to prioritise simplification across IGA, AM, and PAM.
👉 Read Soffid's analysis of IAM trends for 2026 and identity governance priorities →
IAM trends for 2026: what CISOs need to change now?
Explore further
10/07/2026 9:37 pm
Identity governance is becoming a lifecycle problem, not an authentication problem. The article is right to push beyond passwords and login friction because the dominant risk now sits in discovery, privilege scope, and offboarding. Once NHIs outnumber human identities at scale, governance has to track creation, ownership, expiry, and revocation as a continuous state. Practitioners should treat lifecycle control as the core IAM discipline, not a back-office process.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- The same research also finds that only 5.7% of organisations have full visibility into their service accounts, which explains why discovery gaps persist.
A question worth separating out:
Q: How do teams know whether their IAM architecture is actually under control?
A: They should track a small set of measurable indicators, such as orphaned service accounts, phishing-resistant authentication coverage, and mean time to contain identity anomalies. If those measures are not improving, the architecture is probably distributing control across tools without closing the gaps between them. Control must be visible to be credible.
👉 Read our full editorial: IAM trends for 2026 show identity is now the attack entry point
