Topic starter
25/08/2026 6:10 pm
TL;DR: By 2028, 70% of CISOs will use an identity visibility and intelligence platform to reduce IAM attack surface, according to Veza’s citation of Gartner research. The shift reflects a programme reality: visibility, observability, and remediation now define whether human, machine, and AI identities can be governed at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “New Gartner Report: Reduce Your IAM Attack Surface Using Visibility, Observability, and Remediation”.
By the numbers:
- By 2028, 70% of Chief Information Security Officers will utilize an identity visibility and intelligence platform to shrink their IAM attack surface.
Key questions
Q: What do organisations get wrong when they treat human, machine, and AI identities the same?
A: They apply one policy model to identities with very different lifecycles, behaviours, and evidence requirements.
Q: Why does transparency matter in IAM and identity governance?
A: Transparency matters because governance breaks down when people cannot explain how access decisions are made or why a control exists.
Q: What are the signs that an IAM programme has too much hidden identity risk?
A: Common signs include unclear ownership of service accounts, recurring privilege exceptions, slow remediation of risky access, and an inability to explain who can reach critical systems through indirect paths.
Practitioner guidance
- Map transitive access paths Identify where indirect permissions, inherited roles, and delegated trust relationships expand the effective attack surface across your identity estate.
- Prioritise remediation by blast radius Rank identities by the number of systems, data sets, and critical workflows they can reach, then remediate the highest-exposure accounts first.
- Include non-human identities in review cycles Extend visibility and entitlement governance to service accounts, tokens, and other machine identities so they are not outside the same risk controls.
Bottom line: Identity visibility platforms are moving from nice-to-have reporting layers to core controls for reducing IAM attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Identity visibility is becoming the front line of IAM risk reduction. The old assumption was that identity governance could rely on periodic reviews, static reports, and separate tooling for access analysis. That model breaks when exposure is distributed across human, machine, and AI identities and attackers move faster than review cycles. The practical conclusion is that visibility is no longer a supporting function; it is the control plane that determines whether IAM risk can be reduced at all.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: When should organisations separate human IAM from NHI governance?
A: Organisations should separate them whenever service accounts, API keys, tokens, or certificates are part of the access estate. Human identity controls are built around user behaviour and interactive authentication, while NHI governance must address secrets, standing privileges, rotation, and offboarding. Treating them as the same model leaves machine access under-governed.
👉 Read our full editorial: Identity visibility platforms are becoming central to IAM risk reduction