Topic starter
22/06/2026 1:42 pm
TL;DR: As enterprises accelerate digital transformation, unmanaged identities, orphaned accounts, and sprawl across hybrid environments are creating a blind spot that SSO and MFA cannot cover, according to SPHERE Technology Solutions. Non-human identities now outnumber human identities 82 to 1, making upstream hygiene and continuous evidence-driven monitoring central to IAM and PAM governance.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “Why Identity Hygiene is the Missing Security Layer for Zero Trust Success”.
By the numbers:
- Non-human identities now outnumber human identities 82 to 1, according to SPHERE.
Key questions
Q: What breaks when identity governance is missing from an IAM programme?
A: The main failure is entitlement drift.
Q: Why do unmanaged non-human identities create such a large security gap?
A: Unmanaged non-human identities create risk because they scale faster than manual review processes and often sit outside clear business ownership.
Q: How can teams tell whether PAM is working on accurate identity data?
A: PAM is working on accurate identity data when privileged accounts, ownership records, and entitlement scopes match what is actually deployed across the environment.
Practitioner guidance
- Map every non-human identity to an accountable owner Create a live inventory of service accounts, automation identities, tokens, and integration credentials, then require a named business and technical owner for each one.
- Move identity hygiene upstream of PAM reviews Validate account ownership, entitlement scope, and retirement status before privileged access recertification so reviewers work from current identity evidence.
- Reconcile orphaned accounts across hybrid systems Search Active Directory, SaaS platforms, cloud services, and migration artefacts for identities that lack an owner, purpose, or current business sponsor.
Bottom line: Identity hygiene is now a core governance problem because authentication controls alone do not reveal orphaned accounts or stale privileges.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 1:47 pm
Identity hygiene is becoming the governing assumption behind modern IAM, not a cleanup task at the end of it. SSO and MFA authenticate access, but they do not prove that every identity still has a valid owner, purpose, and retirement path. That distinction matters because hybrid estates accumulate access faster than quarterly governance cycles can reconcile it. The practitioner implication is that identity hygiene has to sit upstream of access reviews, not downstream of them.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do when SSO and MFA are already in place?
A: Security teams should treat SSO and MFA as authentication controls, then add lifecycle governance for identities that exist outside user login flows. The next step is to inventory machine identities, assign owners, and verify offboarding evidence so access can be retired as systems change. That is how identity hygiene closes the gap left by login controls.
👉 Read our full editorial: Identity hygiene and NHI sprawl are outpacing legacy controls