Topic starter
30/09/2026 7:10 pm
TL;DR: P0 Security argues that identity programmes keep fragmenting across IAM, IGA, PAM, CIEM, ITDR, and ISPM while multi-cloud, non-human identities, and agentic AI expose gaps that point tools cannot close. The real shift is to rationalise standing privilege, visibility, and outcome measurement before adding another platform.
Editorial analysis by NHI Mgmt Group, based on content published by P0 Security: “How CISOs should approach their identity security programs: a first principles guide”.
Key questions
Q: What should security teams do first when identity tools keep multiplying?
A: Start by mapping standing privilege across human and non-human identities, then remove the access paths that exist only because different tools own different slices of the same environment.
Q: Why do standing permissions increase risk for machine identities?
A: Standing permissions increase risk because they remain useful long after the original task ends.
Q: Where do IAM and PAM programmes most often fail in multi-cloud estates?
A: They fail when access is treated as a tool-specific problem instead of a shared governance problem.
Practitioner guidance
- Eliminate standing privilege where access is repeatable Identify permissions that exist outside a task window and replace them with task-scoped access tied to actual operational need.
- Build a complete NHI inventory Track service accounts, tokens, API keys, certificates, and workload identities in the same governance process used for human access.
- Replace tool-by-tool reporting with outcome metrics Measure whether the identity programme reduces exposed privilege, shortens access duration, and improves revocation speed across environments.
Bottom line: Identity security sprawl is fundamentally a governance issue, because fragmented tooling cannot compensate for inconsistent control of access across human and non-human actors.
What's in the full article
P0 Security's full whitepaper covers the operational detail this post intentionally leaves for the source:
- A first-principles framework for deciding which identity controls belong at the programme level and which belong in point tools
- The operational logic behind eliminating standing privilege and shifting to just-in-time access
- Guidance on measuring identity risk reduction with outcomes that boards and auditors can understand
- How the paper connects multi-cloud access, non-human identities, and emerging agentic AI to programme design
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/09/2026 7:11 pm
Identity sprawl is a governance failure before it is a tooling problem. When organisations split identity control across separate products for IAM, PAM, NHI, and cloud access, they create overlapping authorities and blind spots that no dashboard can reconcile. The programme starts to optimise around tools instead of access outcomes, which is why boards still struggle to see whether risk is actually falling. Practitioners should treat access architecture as a single governance problem with multiple actors, not as a product catalog.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 1 in every 1,000 non-human identities in enterprise environments is more than 10 years old.
A question worth separating out:
Q: How should organisations govern non-human identities across their environment?
A: Start by inventorying every machine identity, assigning a human owner, and tying each one to a business purpose. Then apply routine access review, least privilege, and revocation for stale accounts. NHIs should be governed as accountable identities, not as background infrastructure that can be left unmanaged.
👉 Read our full editorial: First principles for identity security programs beyond tool sprawl