Topic starter
25/06/2026 1:00 am
TL;DR: Identity security teams now average 11 tools, with 70% planning to expand an existing tool and 62% expecting to add a new one, Silverfort reports from ESG research. Fragmented identity stacks make it harder to correlate access across workforce, NHI, and AI agent activity.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “ESG research uncovers 70% of enterprises recognize the need to consolidate their identity security tool stack”.
By the numbers:
- Identity security teams use an average of 11 tools, which contributes to operational complexity, poor visibility, and identity silos.
- 70% of teams plan to expand usage of an existing tool to cover a new use case in the next 12-18 months.
- 91% of organizations surveyed consider identity security one of their top five priorities in the next 12-24 months.
Key questions
Q: Why do non-human identities push organisations toward broader identity platforms?
A: NHIs such as service accounts and API keys increase the number of identities, credentials, and lifecycle events that must be governed.
A: The clearest signs are improved cross-domain visibility, fewer duplicate policy paths, and better explanation of who or what accessed a resource and why.
Q: How should security teams reduce identity sprawl without weakening governance?
A: Start by identifying where identity, access, and device controls are split across tools, then remove duplicate policy paths before consolidating.
Practitioner guidance
- Map identity control fragmentation Inventory where MFA, NHI security, ITDR, and related functions are split across separate products, then trace which logs and policy decisions each one owns.
- Extend governance to NHIs and agents Treat service accounts, API keys, and AI agents as first-class identity subjects in access reviews, policy scoping, and monitoring design.
- Test consolidation for context, not count Evaluate platforms on whether they preserve identity-specific context across human, machine, and agent access rather than merely reducing the number of screens.
Bottom line: Identity security sprawl is now a governance issue because fragmented tools weaken the organisation’s ability to see and correlate access across different identity types.
Glossary terms: Identity Tool Sprawl, Identity Security Platformisation, Non-Human Identity (NHI), Identity context
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/06/2026 10:09 am
Tool sprawl has become an identity governance problem, not just a procurement problem. When teams average 11 tools across identity functions, they are not simply overbuying. They are creating fragmented evidence, duplicated policy, and inconsistent control outcomes across workforce, NHI, and agentic access paths. The practical consequence is that no one system has the full context needed to govern identity risk cleanly, so the programme becomes harder to certify, harder to audit, and harder to operate.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations use the same controls for humans, NHIs, and AI agents?
A: No. The control family may overlap, but the operating assumptions differ. Human identity controls focus on authentication and user context, while NHIs need lifecycle and credential governance, and AI agents require both NHI controls and runtime oversight for autonomous action. The correct model is shared governance with actor-specific enforcement.
👉 Read our full editorial: Identity security tool sprawl is driving platform consolidation