Topic starter
07/06/2026 9:00 pm
TL;DR: Identity security is at a breaking point, with leaders reporting low preparedness, ongoing identity-related incidents, and rising expectations that AI will reshape detection and response across IGA, NHI, and least-privilege programmes, according to Lumos’ 2026 research. The real issue is not more automation, but governance models that still assume identity risk is slow, visible, and human-paced.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “AI, Automation, and Risk in 2026”.
Key questions
Q: Why do current IAM controls fail when identity attacks move faster than review cycles?
A: Current IAM controls fail because they assume privilege exists long enough to be reviewed, challenged, and removed through human-paced processes.
Q: When should organisations prioritise AI-driven identity detection over more manual access review?
A: Organisations should prioritise AI-driven detection when manual review cannot keep pace with identity anomaly volume, lateral movement risk, or rapid entitlement changes.
Q: What breaks when non-human identities are not governed like human accounts?
A: Service accounts, API keys, tokens, and AI agents can retain access long after the original task ends because they do not naturally pass through joiner-mover-leaver processes.
Practitioner guidance
- Measure identity blast radius Map the maximum reachable systems, data, and administrative functions behind each high-risk account, then rank identities by the damage they can cause before containment.
- Separate NHI governance from human access review Create ownership, rotation, and revocation workflows for service accounts, tokens, and API keys that do not depend on employee-centric joiner-mover-leaver logic.
- Shorten the lifetime of standing privilege Replace persistent elevated access with task-scoped or time-bound entitlement patterns wherever operationally possible, especially for administrative and cross-system access paths.
Bottom line: The article’s central warning is that identity risk is moving faster than governance processes built for slower, human-paced review cycles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
08/06/2026 8:45 am
Identity security has crossed from governance problem to execution problem. The article’s core signal is that identity attacks now outpace the cadence of traditional access governance. That means the old assumption, that review cycles can catch the dangerous identity before it is abused, is no longer reliable. Practitioners should read this as a shift from policy sufficiency to operational containment.
A question worth separating out:
Q: How do security teams know whether identity governance is reducing risk?
A: Look for shorter time from access change to visibility, fewer unmanaged entitlements, and faster completion of review and remediation cycles. If access risk remains unchanged after deployment, the programme may be reporting activity without changing control outcomes.
👉 Read our full editorial: AI, automation and identity risk in 2026: the breaking point
This post was modified 3 days ago by NHI Mgmt Group