Notifications
Clear all
Topic starter
25/06/2026 1:00 am
TL;DR: ESG surveyed 370 IT and cybersecurity decision-makers and found that 91% rank identity security among their top five priorities, while 70% plan to expand an existing tool and 62% expect to add a new one, underscoring how tool sprawl is shaping programme strategy according to Silverfort. The real issue is not more tools, but whether teams can unify visibility across workforce, NHI, and AI agent access without creating new silos.
NHIMG editorial — based on content published by Silverfort: Identity Security at a Crossroads: Balancing Stability, Agility, and Security
By the numbers:
- ESG surveyed 370 IT and cybersecurity decision-makers across multiple industries, mostly organisations with at least 1,000 employees.
- 70% of teams plan to expand usage of an existing tool to cover a new use case in the next 12-18 months.
- 91% of organisations surveyed consider identity security one of their top five priorities in the next 12-24 months.
Questions worth separating out
Q: How should security teams reduce identity tool sprawl without losing control quality?
A: Start by mapping every identity control to a clear owner, a clear data source, and a clear decision point.
Q: Why does NHI growth make identity consolidation more urgent?
A: NHIs increase the number of identities that must be governed outside human login workflows, which makes fragmented tools harder to operate safely.
Q: What do security teams get wrong about platform consolidation in identity security?
A: They often focus on product count instead of decision quality.
Practitioner guidance
- Rationalise identity control ownership across stacks Document which team owns authentication, entitlement, NHI oversight, and detection for each identity class.
- Build a single identity visibility model Unify logs and entitlement data so analysts can see workforce access, service account usage, and agent activity in one investigation path.
- Classify identities by actor type and lifecycle Separate humans, NHIs, and AI agents in governance workflows, then apply the right ownership and review process to each.
What's in the full report
Silverfort's full article covers the operational detail this post intentionally leaves for the source:
- The full survey breakdown across 18 identity security functional areas, including how many teams use multiple tools in each category.
- The report's environment split analysis showing why separate on-prem and cloud tooling keeps driving sprawl.
- The underlying survey methodology and respondent profile, useful if you need to judge how representative the findings are.
- The article's discussion of how buyers are thinking about AI agent security, ITDR, and ISPM in the same portfolio conversation.
👉 Read Silverfort's analysis of ESG identity security research →
Identity security tool sprawl: what consolidation means for teams?
Explore further
25/06/2026 10:09 am
Identity tool sprawl is now a governance failure, not just an efficiency problem. When teams manage MFA, NHI security, and identity threat detection in separate stacks, they create control gaps between ownership, visibility, and enforcement. That gap matters because identity risk is rarely isolated to one product domain. Practitioners should treat sprawl as an architecture defect that weakens every downstream identity decision.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: How can organisations tell whether identity security is still too fragmented?
A: If analysts need multiple consoles to answer basic questions about access, privilege, and activity, the programme is still fragmented. Another signal is when ownership differs across tools and no one can explain who is accountable for a single identity event end to end. That is a governance gap, not just a tooling issue.
👉 Read our full editorial: Identity security tool sprawl is driving platform consolidation
