Notifications
Clear all
Topic starter
24/06/2026 9:11 pm
TL;DR: Identity sprawl, orphaned accounts, stale entitlements and unmanaged non-human identities are described as the hidden conditions behind many breaches, with SPHERE arguing that identity intelligence can move teams from visibility to continuous remediation. The real issue is not discovery alone, but whether governance can keep pace with changing ownership, privilege and lifecycle state.
NHIMG editorial — based on content published by SPHERE: Avoiding a Breach via Automated Identity Intelligence
Questions worth separating out
Q: How should teams reduce risk from orphaned accounts and stale entitlements?
A: Start by attributing each identity to an owner, a purpose, and a lifecycle state.
Q: Why do non-human identities create persistent governance problems?
A: Non-human identities are often created for convenience and then left behind when the original use case changes.
Q: What breaks when identity governance relies on visibility alone?
A: Visibility without attribution leaves teams with a list of accounts but no dependable way to decide what should be removed, reviewed, or escalated.
Practitioner guidance
- Build a complete identity ownership map Link every account, entitlement, and NHI to a named business or technical owner, then flag anything that cannot be attributed.
- Separate human and non-human lifecycle controls Track service accounts, API keys, certificates, and workload identities in a distinct governance flow so their review, rotation, and offboarding rules do not disappear inside user-centric IAM processes.
- Prioritise stale and over-permissioned identities first Use risk scoring to target orphaned accounts, nested group exposure, and excessive access before lower-value cleanup work.
What's in the full report
SPHERE's full white paper covers the operational detail this post intentionally leaves for the source:
- Specific guidance on identity discovery and attribution workflows across complex environments
- Operational examples of how identity intelligence supports remediation rather than just reporting
- Product-level discussion of SPHEREboard modules and integrations for identity risk management
- Implementation detail on sustaining identity hygiene across accounts, groups, and non-human identities
👉 Read SPHERE's white paper on automated identity intelligence and breach avoidance →
Identity intelligence and IAM hygiene: what teams are missing?
Explore further
25/06/2026 6:15 am
Identity intelligence is becoming the control layer that traditional IAM left incomplete. Visibility tools can locate accounts, but they do not by themselves resolve ownership, legitimacy, or residual privilege. The governance gap is not discovery, it is the absence of a mechanism that turns discovery into action. Practitioners should treat identity intelligence as the missing bridge between inventory and enforcement.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means most environments still cannot reliably enumerate machine identity exposure.
A question worth separating out:
Q: How can security teams tell whether identity hygiene is actually improving?
A: Look for shorter time to resolve orphaned identities, fewer accounts with unclear ownership, and a steady decline in excessive privilege over time. If risky identities keep reappearing after reviews, the programme is measuring state, not controlling it. Improvement shows up in repeatable closure, not in prettier dashboards.
👉 Read our full editorial: Identity intelligence closes the breach gap in messy IAM stacks
