Topic starter
11/12/2025 4:13 pm
TL;DR: Unmanaged identities across workforce, machine, developer, and agentic AI estates create security, compliance, and operational risk by expanding attack paths, weakening accountability, and outpacing traditional inventory and lifecycle controls, according to Delinea. The core issue is not simply visibility, but governance that assumes identities stay tracked and stable long enough to be reviewed.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Uncovering the risks of unmanaged identities”.
Key questions
Q: What breaks when non-human identities are managed outside the IAM operating model?
A: What breaks is accountability.
Q: Why do non-employee identities create so much audit and compliance risk?
A: They often sit outside the normal HR-driven lifecycle and can change faster than manual governance can track.
Q: How can security teams spot unmanaged identity problems early?
A: Look for identities with unclear ownership, shared privileged access, dormant accounts that still authenticate, and machine or agentic identities created outside approved workflows.
Practitioner guidance
- Map unmanaged identity sources across all estates Build a single discovery workflow for workforce, developer, admin, machine, and AI identities across cloud, on-premises, and hybrid platforms.
- Automate joiner-mover-leaver handling for non-human identities Apply lifecycle controls to service accounts, machine identities, and agentic AI identities so that creation, change, and offboarding are not left to manual follow-up.
- Enforce least privilege and JIT for every identity class Remove persistent permissions from identities that do not need them and issue access only when the task requires it.
Bottom line: Unmanaged identities are a governance problem as much as a security problem, because once identities fall outside the inventory, normal control points no longer apply.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:44 am
Unmanaged identity is an inventory failure before it is an access failure. The central governance problem is not that identities are merely poorly secured, but that they fall outside the system of record that makes security decisions possible. Once that happens, every later control, from review to offboarding, becomes probabilistic rather than authoritative. The practitioner implication is that discovery coverage is the first governance control, not a supporting one.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: Should organisations treat agentic AI as a workload identity problem or an AI problem?
A: They should treat it as both, but the control failure shows up first in workload identity. The AI may decide what to do, but the blast radius is governed by service accounts, tokens, permissions, and orchestration rules. If those controls are weak, the agent’s autonomy simply moves faster than the guardrails.
👉 Read our full editorial: Unmanaged identities are widening identity risk across human and NHI estates