Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Workforce identity now spans humans, service accounts, and AI agents, while 0.01% of non-human identities control 80% of cloud resources and the average worker holds 96,000 entitlements, according to Veza. The governance problem is no longer visibility alone, but authorization, lifecycle control, and auditability across a sprawl of identities that conventional IAM models were never built to manage.
NHIMG editorial — based on content published by Veza: an analysis of Forrester’s Workforce Identity Security Platforms Landscape
By the numbers:
- 0.01% of non-human identities control 80% of cloud resources.
Questions worth separating out
Q: Should organisations use the same controls for humans, NHIs, and AI agents?
A: No. The control family may overlap, but the operating assumptions differ. Human identity controls focus on authentication and user context, while NHIs need lifecycle and credential governance, and AI agents require both NHI controls and runtime oversight for autonomous action. The correct model is shared governance with actor-specific enforcement.
Q: Why do entitlement sprawl and identity debt create so much risk?
A: Entitlement sprawl creates risk because permissions accumulate faster than review cycles can remove them.
Q: What breaks when organisations rely on manual access reviews for NHIs?
A: Manual access reviews break down when identities are created dynamically and change faster than the review cycle.
Practitioner guidance
- Build a unified entitlement inventory Aggregate access data across SSO, cloud, SaaS, service accounts, and AI-linked workloads so governance decisions are based on one current view of permissions.
- Rework access reviews around effective authorization Review what identities can actually do in business systems, not just whether the account exists or the owner signed off on provisioning.
- Separate identity debt from fresh access requests Track stale entitlements, dormant accounts, and unused privileges as a distinct remediation stream so new requests do not mask old risk.
What's in the full article
Veza's full analysis covers the operational detail this post intentionally leaves for the source:
- How Forrester categorises workforce identity security platforms across governance, posture management, and machine or AI identity use cases.
- The vendor's discussion of how its product set maps to IGA, ISPM, NHI security, and AI agent security.
- The specific ways Veza positions automation for access reviews, audit evidence, and entitlement analysis across enterprise systems.
- The full report context behind the cited statistics on NHI concentration and workforce entitlement volume.
👉 Read Veza's analysis of workforce identity security platforms and NHI governance →
Workforce identity security platforms: are your controls keeping up?
Explore further
25/08/2026 6:11 pm
Workforce identity security is becoming the operating layer for identity governance. The article reflects a broader market reality: IAM no longer ends at authentication, because the real risk sits in what identities can do after they are admitted. That changes the role of identity security from perimeter control to continuous authorization governance across human, NHI, and AI-driven access paths. Practitioners should treat workforce identity as a shared control plane, not a product category.
A few things that frame the scale:
- From our research: Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to the 2024 Non-Human Identity Security Report.
- Our 2024 Non-Human Identity Security Report also found that 35.6% of organisations cite managing consistent access across hybrid and multi-cloud environments as their top NHI security challenge.
A question worth separating out:
Q: Who should be accountable for workforce identity verification controls?
A: Accountability should be shared, but not diffuse. HR owns policy language, Security owns assurance requirements, IAM owns the access outcome, and Legal and Compliance validate defensibility. The control fails when one group owns the form but no one owns the access result.
👉 Read our full editorial: Workforce identity security is becoming an enterprise control plane
