Topic starter
25/06/2026 1:00 am
TL;DR: ESG surveyed 370 IT and cybersecurity decision-makers and found that 91% rank identity security among their top five priorities, while 70% plan to expand an existing tool and 62% expect to add a new one, underscoring how tool sprawl is shaping programme strategy according to Silverfort. The real issue is not more tools, but whether teams can unify visibility across workforce, NHI, and AI agent access without creating new silos.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “ESG research uncovers 70% of enterprises recognize the need to consolidate their identity security tool stack”.
By the numbers:
- Identity security teams use an average of 11 tools, which contributes to operational complexity, poor visibility, and identity silos.
- 70% of teams plan to expand usage of an existing tool to cover a new use case in the next 12-18 months.
- 91% of organizations surveyed consider identity security one of their top five priorities in the next 12-24 months.
Key questions
Q: How should security teams reduce identity sprawl without weakening governance?
A: Start by identifying where identity, access, and device controls are split across tools, then remove duplicate policy paths before consolidating.
Q: Why do non-human identities push organisations toward broader identity platforms?
A: NHIs such as service accounts and API keys increase the number of identities, credentials, and lifecycle events that must be governed.
A: The clearest signs are improved cross-domain visibility, fewer duplicate policy paths, and better explanation of who or what accessed a resource and why.
Practitioner guidance
- Map identity control fragmentation Inventory where MFA, NHI security, ITDR, and related functions are split across separate products, then trace which logs and policy decisions each one owns.
- Extend governance to NHIs and agents Treat service accounts, API keys, and AI agents as first-class identity subjects in access reviews, policy scoping, and monitoring design.
- Test consolidation for context, not count Evaluate platforms on whether they preserve identity-specific context across human, machine, and agent access rather than merely reducing the number of screens.
Bottom line: Identity security sprawl is now a governance issue because fragmented tools weaken the organisation’s ability to see and correlate access across different identity types.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:09 am
Tool sprawl has become an identity governance problem, not just a procurement problem. When teams average 11 tools across identity functions, they are not simply overbuying. They are creating fragmented evidence, duplicated policy, and inconsistent control outcomes across workforce, NHI, and agentic access paths. The practical consequence is that no one system has the full context needed to govern identity risk cleanly, so the programme becomes harder to certify, harder to audit, and harder to operate.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations use the same controls for humans, NHIs, and AI agents?
A: No. The control family may overlap, but the operating assumptions differ. Human identity controls focus on authentication and user context, while NHIs need lifecycle and credential governance, and AI agents require both NHI controls and runtime oversight for autonomous action. The correct model is shared governance with actor-specific enforcement.
👉 Read our full editorial: Identity security tool sprawl is driving platform consolidation