Notifications
Clear all
Topic starter
21/08/2026 4:42 pm
TL;DR: KuppingerCole Analysts’ Leadership Compass on Identity and Access Governance says modern IAG must govern distributed identity ecosystems across workforce users, privileged users, applications, APIs, workloads, bots, and other non-human identities, with evaluation focused on access certification, entitlement management, segregation of duties, policy enforcement, risk analytics, automation, and security integration, according to Pathlock. The governance problem is no longer just who gets access, but how consistently that access is reviewed, constrained, and enforced across identity types and environments.
NHIMG editorial — based on content published by Pathlock: Leadership Compass for Identity and Access Governance
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should organisations govern non-human identities alongside employee access?
A: Organisations should govern NHIs with the same discipline used for human access, but with stronger lifecycle ownership and expiry controls.
Q: Why do access certification processes often fail for workloads and service accounts?
A: Because certification workflows were designed around people, managers, and job changes, not identities that persist independently of employment cycles.
Q: What do security teams get wrong about entitlement management in distributed environments?
A: They often treat entitlements as platform-specific records instead of a governed inventory spanning cloud, SaaS, infrastructure, and APIs.
Practitioner guidance
- Inventory non-human identities with named ownership Build a single register for service accounts, APIs, workloads, and bots, and require an accountable owner for every entry.
- Normalise entitlements before certification cycles Translate raw permission sets into business-readable entitlement records so reviewers can see what access exists and why it matters.
- Correlate segregation of duties across systems Check for toxic combinations across applications, cloud services, and infrastructure rather than inside one platform at a time.
What's in the full article
Pathlock's full analysis covers the operational detail this post intentionally leaves for the source:
- The analyst scoring criteria used to evaluate identity and access governance vendors across access certification, entitlement management, and policy enforcement.
- The capability breakdown behind automation, risk analytics, and integrations that matter when governance spans apps, APIs, workloads, and bots.
- The market comparison lens used by KuppingerCole Analysts when ranking IAG vendors for distributed identity environments.
👉 Read Pathlock's analyst coverage of identity and access governance leaders →
Identity and access governance for apps, workloads, and bots?
Explore further
21/08/2026 5:03 pm
Identity and access governance is no longer a human-only discipline. The article reflects a structural change in the identity estate: applications, workloads, APIs, and bots now sit inside the same governance perimeter as workforce users. That widens the scope of certification, entitlement management, and policy enforcement without changing the underlying governance obligation. The practitioner takeaway is that IAG programmes must be designed for actor diversity, not just user populations.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, and 47% have only partial visibility, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: What frameworks help align NHI governance with modern identity security?
A: The most relevant starting points are the NIST Cybersecurity Framework 2.0 for governance structure and the NHI governance guidance in the Ultimate Guide to NHIs for lifecycle, visibility, and rotation. Together they help teams map ownership, access review, and revocation across machine and human identities.
👉 Read our full editorial: Identity and access governance now spans workforce and non-human identities
