Notifications
Clear all
Topic starter
04/07/2026 7:49 pm
TL;DR: Identity security is fragmenting into ITDR, ISPM, NHI and IVIP because traditional IAM still leaves blind spots around compromised credentials, excessive entitlements and machine identities, according to Widefield Security. The real issue is not missing controls, but whether identity programmes can produce measurable reduction in exposure across human and non-human access.
NHIMG editorial — based on content published by Widefield Security: ITDR, ISPM, NHI and IVIP: Do We Really Need More Identity Categories or Do We Need Better Outcomes?
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
Questions worth separating out
Q: How should security teams reduce identity risk without adding more tools?
A: Start by mapping where your current controls already see authentication, entitlement, and usage data, then identify the gaps where no system has full visibility.
Q: Why do machine identities make identity governance harder than human access?
A: Machine identities often outnumber human users, change faster, and are less consistently owned or reviewed.
Q: What signals show that an identity programme is actually improving?
A: Look for fewer orphaned accounts, fewer excessive entitlements, reduced exposure of machine credentials, and faster remediation of high-risk access.
Practitioner guidance
- Build a single identity inventory across human and non-human accounts Correlate identity provider data, cloud entitlements, SaaS access, PAM records, and machine identities so ownership and privilege can be reviewed in one place.
- Separate detection, posture, and governance use cases Use ITDR for runtime attack detection, ISPM for configuration hygiene, and governance workflows for access review and remediation so each control has a clear job.
- Prioritise identities with the largest exposure footprint Rank accounts and credentials by privilege, connected systems, and business criticality, then focus remediation on the identities that can create the widest blast radius.
What's in the full article
Widefield Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The article's category-by-category breakdown of ITDR, ISPM, and IVIP use cases and how they differ in practice.
- The vendor's discussion of why identity teams still struggle to get a complete view across cloud, SaaS, and on premises systems.
- The market framing behind Gartner's identity visibility and intelligence view and how it affects category consolidation.
- The broader argument on why outcomes matter more than acronyms when identity risk is measured at enterprise scale.
👉 Read Widefield Security's analysis of identity category sprawl and IAM outcomes →
Identity category sprawl: what outcomes are teams actually getting?
Explore further
04/07/2026 7:54 pm
Category sprawl is a symptom of governance failure, not a sign of maturity. ITDR, ISPM, and IVIP have emerged because existing IAM programmes often cannot connect authentication, entitlement, and usage data into one operational view. That means teams keep adding category-specific tools to compensate for a governance model that never fully mapped the identity attack surface. Practitioners should treat category growth as evidence of unresolved control fragmentation, not progress.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured.
A question worth separating out:
Q: Which frameworks help teams structure identity visibility and control?
A: NIST Cybersecurity Framework 2.0 helps organise governance, protection, detection, response, and recovery. For non-human identities, the OWASP Non-Human Identity Top 10 is useful for spotting common failure modes, while the Ultimate Guide to NHIs helps teams connect visibility, lifecycle, and access controls into one operating model.
👉 Read our full editorial: Identity categories are multiplying because outcomes still lag IAM
