Notifications
Clear all
Topic starter
04/07/2026 9:26 pm
TL;DR: Identity security has shifted from protecting a directory to watching a distributed fabric of federated trust, SaaS tokens, and non-human identities that outnumber people many to one, according to Abnormal AI. The real control gap is behavioural visibility across the seams, because hardening sign-in alone does not reveal what identities do after authentication.
NHIMG editorial — based on content published by Abnormal AI: Identity is now a fabric: why seams, not logins, are the risk
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams monitor identity risk across federated SaaS environments?
A: Security teams should correlate identity events across the IdP and each downstream application, then alert on abnormal post-authentication behaviour.
Q: Why do service accounts and OAuth grants create more risk than a single directory account?
A: They create more risk because access is distributed, inherited, and often weakly owned.
Q: What do IAM teams get wrong about stronger MFA and conditional access?
A: They often assume a stronger sign-in control will solve identity risk across the environment.
Practitioner guidance
- Map the full identity fabric Inventory the IdP, downstream SaaS applications, service accounts, OAuth grants, and token issuers that participate in the access chain.
- Establish ownership for every NHI Assign a responsible owner for each service account, API token, and OAuth grant, then validate that the owner can explain why the identity exists and what systems it should touch.
- Baseline behaviour for high-value identities Define normal access patterns for accounts that touch payroll, CRM, finance, or production data, and alert on deviations in time, target system, or action type.
What's in the full article
Abnormal AI's full blog post covers the operational detail this post intentionally leaves for the source:
- How the vendor models identity behaviour across email and SaaS environments to spot post-authentication anomalies
- Examples of activity patterns that stand out when an identity touches Workday or Salesforce in an unusual way
- The vendor's explanation of why sign-in hardening alone does not expose activity across the identity fabric
- Operational framing for behavioural AI in identity security programs
👉 Read Abnormal AI's analysis of identity seams and behavioural identity detection →
Identity seams and NHI sprawl: are your controls keeping up?
Explore further
04/07/2026 9:28 pm
Identity security has become a fabric problem, not a directory problem. The article is right to focus on seams, because the decisive risk is now distributed across identity providers, SaaS applications, and workload credentials. Traditional controls still treat sign-in as the main event, but the real attack surface begins after authentication. Practitioners should reframe identity governance around continuity of trust across the full access path.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: How should organisations decide where to apply behavioural identity monitoring first?
A: Start with identities that can reach financial data, customer systems, production workloads, or administrative functions across multiple applications. Those accounts have the greatest blast radius and the least tolerance for blind spots. Behavioural monitoring should begin where authentication success is least informative about whether access is appropriate.
👉 Read our full editorial: Identity is now a fabric: why seams, not logins, are the risk
