Topic starter
02/06/2026 6:53 pm
TL;DR: Invisible identity now outweighs visible identity 57% to 43%, according to Orchid Security’s Identity Gap: 2026 Snapshot, while 67% of non-human accounts are created directly inside applications and remain unseen by IAM programs. The structural gap matters because AI agents inherit access and exploit unmanaged pathways at machine speed, making governance a discovery problem before it is a control problem.
Editorial analysis by NHI Mgmt Group, based on content published by Orchid Security: “Two-Thirds of Nonhuman Accounts Are Unseen and Unmanaged, According to New Identity Gap Report”.
By the numbers:
- Invisible identity now outweighs visible identity across enterprise environments, 57% to 43%.
- 67% of non-human accounts are created directly within the application and remain unseen by IAM programs.
- 70% of enterprise applications contain an excessive number of privileged accounts.
Key questions
Q: What breaks when application-native identities sit outside IAM visibility?
A: Joiner-mover-leaver, recertification, and offboarding controls lose coverage when accounts are created inside the application instead of the directory.
Q: Why do hidden NHI and local accounts increase security risk so quickly?
A: They create standing access that bypasses the normal identity lifecycle, so revocation, rotation, and ownership checks happen late or not at all.
Q: What are the signs that identity governance is missing application-level accounts?
A: Look for applications that authenticate locally, credentials stored in clear text, orphaned accounts, or privileged access that never appears in directory records.
Practitioner guidance
- Inventory identities at the application layer Build a discovery process for accounts, secrets, and authentication paths that are created inside applications and never appear in the directory.
- Classify hidden NHI as a governance population Separate local accounts, embedded credentials, orphaned accounts, and application-native service identities so they can each be governed on their own lifecycle terms.
- Eliminate standing privilege in unmanaged paths Review applications that authenticate locally or bypass the identity provider and remove excessive privilege before those pathways become the default access route.
Bottom line: The core risk is that enterprise identity is being created and used outside the control points that IAM and IGA were built to see.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 7:06 pm
Identity dark matter is not a visibility edge case, it is the operating condition many enterprises already run on. When 57% of identity is invisible and two-thirds of non-human accounts are born inside applications, the control gap is no longer theoretical. IAM programmes built around directory completeness are governing a subset of the real estate. The implication is that identity governance must start with discovery of the actual control surface, not with policy over the one that is easiest to measure.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams prepare AI agents to use only governed access paths?
A: Start by removing unmanaged login routes, embedded secrets, and orphaned privileged accounts that an agent could exploit faster than a human reviewer can respond. Then validate that the agent can complete tasks only through identities that are inventoried, owned, and lifecycle-managed.
👉 Read our full editorial: Identity dark matter is widening the NHI governance gap