Topic starter
24/06/2026 10:58 pm
TL;DR: Identity security is a single control problem spanning workforce, machine, and AI identities, according to CyberArk, backed by a claim that 87% of organisations have experienced at least two successful identity-related breaches. The real issue is not breadth of coverage, but whether privilege, lifecycle, and governance controls can operate consistently across identity types that behave very differently.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “Your organization runs on identity — human, machine and AI.”.
By the numbers:
- 87% of organisations have experienced at least two successful identity-related breaches.
Key questions
Q: How should security teams build identity governance across humans, machines, and AI agents?
A: Start with a single inventory that records identity type, ownership, access scope, and system relationships across human users, service accounts, tokens, and AI agents.
Q: Why do privilege controls fail when one model is applied to every identity type?
A: Because the access path is different.
Q: What breaks when access reviews are the primary identity control?
A: The control breaks because access can change, be abused, and disappear between review cycles.
Practitioner guidance
- Map every identity class to a named owner Separate workforce, machine and AI identities in your governance model, then assign an accountable owner for each class so discovery, review and offboarding do not rely on a single directory record.
- Split privilege policy by identity behaviour Define different entitlement rules for humans, NHIs and AI actors so session controls, secret use, and delegated execution are governed according to how the identity actually behaves.
- Tie lifecycle events to review triggers Trigger access certification when identities are created, repurposed or retired, rather than relying only on calendar-based recertification that may miss short-lived or automated identities.
Bottom line: The article frames identity security as a cross-actor governance problem spanning people, machines and AI-driven systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:47 am
Identity security is now a cross-actor governance problem, not a product category. Once workforce, machine and AI identities are all part of the same enterprise attack surface, the programme question changes from coverage to control consistency. The issue is whether the same policy fabric can govern interactive users, service identities and runtime actors without creating blind spots. Practitioners should treat identity security as a lifecycle discipline first and a tooling decision second.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What does supply chain identity security change for accountability?
A: It makes delegated access and third-party identities part of the core governance boundary. If a supplier, partner or integrator can reach sensitive resources through an identity you do not directly manage, accountability has to include ownership, time limits and revocation discipline, not just contract language or vendor assurance.
👉 Read our full editorial: Identity security for every identity: what CyberArk's message changes