Topic starter
24/08/2026 2:01 pm
TL;DR: Identity governance still fails where applications, service accounts, machine identities, and AI agents sit outside the governed layer, leaving organizations with incomplete visibility into who and what can access critical systems, according to Orchid Security. The real issue is not governance depth, but governance coverage: access that cannot be seen cannot be certified or controlled.
Editorial analysis by NHI Mgmt Group, based on content published by Orchid Security: “IGA Is Only as Complete as the Identities It Can See”.
Key questions
Q: What breaks when machine identities are left outside IGA?
A: Governance becomes incomplete because the identities with the least visibility often retain the most persistent access.
Q: Why do service accounts and machine identities matter under NIS2?
A: Service accounts and machine identities matter because they often carry the permissions that move data, trigger reports, and feed AI workflows.
Q: How can security teams tell whether IGA coverage is actually complete?
A: They should compare the number of applications in governance workflows with the number of applications found through discovery and network evidence.
Practitioner guidance
- Expand the governed identity inventory Build a discovery process that finds application-local accounts, service accounts, privileged identities, API credentials and machine identities before review cycles begin.
- Tie onboarding to governance scope Make application onboarding the trigger for identity discovery, ownership assignment and certification coverage, so unmanaged systems do not stay outside the IGA layer.
- Trace non-human access paths end to end Record how workloads and AI agents authenticate, what credentials they use, and which permissions they inherit from users or service accounts.
Bottom line: IGA programmes can be sophisticated and still miss identities that never enter the governed layer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/08/2026 2:01 pm
Governance coverage is now the limiting control, not governance maturity. Many IGA programmes have improved lifecycle workflows, certification cadence and policy automation, but those controls only work on identities that are already inside scope. The gap is not abstract. It is the difference between managing known identities and ignoring the access that applications quietly maintain for themselves. Practitioners should measure governance completeness before they measure governance sophistication.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organizations manage credentials for AI agents?
A: Organizations should transition from hard-coded credentials to runtime-fetched credentials that enhance security by ensuring that tokens are not stored permanently. Utilizing solutions like the MCP Secret Wrapper can help eliminate the risks associated with static credentials.
👉 Read our full editorial: IGA coverage gaps leave hidden identities outside governance