Topic starter
24/06/2026 10:47 pm
TL;DR: Identity discovery is the prerequisite for reducing identity risk because modern environments now generate human, machine, workload, and AI identities faster than security teams can track them, according to Delinea and Gartner. The core problem is not tool count but blind spots that hide overprivilege, inheritance, and lateral movement paths.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Identity discovery: The overlooked lever in strategic risk reduction”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when identity discovery is incomplete?
A: Governance breaks first, because you cannot certify, rotate, revoke, or offboard identities you cannot see.
Q: Why does incomplete identity visibility increase incident-response risk?
A: Because investigators have to reconstruct who had access while under pressure, and any gap in account ownership or privilege history slows containment.
Q: How do teams know whether application-level identity discovery is working?
A: Look for reduced blind spots between application reality and governance records.
Practitioner guidance
- Expand discovery across all identity classes Map humans, service accounts, workload identities, API keys, tokens, certificates and AI-driven agents into one inventory so that newly created identities are visible when they appear, not after review cycles catch up.
- Build an identity graph for access relationships Model direct and indirect access paths, including nested roles, trust links and cross-account permissions, so escalation chains and lateral movement paths are visible before they are abused.
- Prioritise posture, not just presence Classify each discovered identity for privilege level, lifecycle state, ownership and policy exceptions, then rank remediation by blast radius instead of by ticket volume.
Bottom line: Identity discovery is the control that turns identity sprawl into a governable risk picture rather than an unknown exposure field.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:36 am
Identity discovery is the control that turns identity risk from conjecture into measurable exposure. When teams cannot see every identity, they cannot tell whether overprivilege is isolated, inherited or repeated across environments. That makes discovery the prerequisite for strategic risk reduction, not a supporting hygiene task. Practitioners should treat visibility as the baseline for every identity programme.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How can teams govern machine identities and AI agents in access reviews?
A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers. If a non-human identity can act on sensitive data, it needs a lifecycle owner and a removal path just like any other privileged account.
👉 Read our full editorial: Identity discovery is the missing control in strategic risk reduction