Topic starter
17/08/2026 4:39 pm
TL;DR: C1.ai says identity security breaks first at discovery, then at least privilege, and finally at real-time governance, as blind spots in users, NHIs, groups, and roles leave organisations unable to answer basic access questions or contain sprawl effectively. Static models fail once access changes faster than review and offboarding cycles can keep up.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “Crawl, Walk, Run: Solving Your Identity Crisis”.
Key questions
Q: Where do identity governance programmes fail first in on-prem environments?
A: They fail where the programme depends on direct cloud-to-private-network reach.
Q: Why do least privilege programmes break down in real environments?
A: They usually break because access is copied, inherited, or left in place after a role change.
Q: How should security teams govern non-human identities at scale?
A: Security teams should treat non-human identities as a lifecycle problem with ownership, review, rotation, and revocation built in from the start.
Practitioner guidance
- Build a single identity inventory Aggregate users, groups, roles, permissions, API tokens, service accounts, certificates, and applications into one authoritative record.
- Rationalise group-based access Review groups for unclear ownership, stale membership, and inherited permissions that no longer map to business need.
- Extend governance to NHIs Assign owners, lifecycle status, expiry, and rotation expectations to tokens, service accounts, and certificates.
Bottom line: The article argues that identity risk starts with unknown and unmanaged access, not with a single weak control.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The crawl, walk, run maturity framing as presented by the vendor, including how each stage maps to identity programme scope.
- Examples of the baseline controls discussed for onboarding, access reviews, self-service requests, and role rationalisation.
- The vendor's description of contextual and automated governance for users, NHIs, and applications across cloud and on-prem environments.
- The operational positioning behind its unified control plane approach for identity visibility and access management.
👉 Read C1.ai's analysis of the crawl, walk, run model for identity security →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:45 pm
Identity visibility is now the foundation layer of governance, not a reporting feature. The crawl phase captures the real control problem: organisations cannot govern access they cannot enumerate. That applies equally to humans, NHIs, and emerging AI agents, because the inventory is the prerequisite for every downstream decision. The practitioner conclusion is straightforward: identity programmes that lack complete discovery are still operating blind.
A question worth separating out:
Q: What does runtime governance add that periodic access review does not?
A: Runtime governance responds when access changes, rather than waiting for a review cycle to notice the problem. It is the difference between seeing stale access after it has already accumulated and controlling access while it is being created or modified.
👉 Read our full editorial: C1.ai’s crawl, walk, run model exposes identity governance gaps