Notifications
Clear all
Topic starter
18/08/2026 2:39 pm
TL;DR: Zero Trust data security now has to evaluate access for users, service accounts, workloads, and AI systems across cloud, SaaS, and on-premises environments, according to BigID. The model only works when identity, context, data sensitivity, and continuous monitoring replace perimeter trust assumptions, and that means NHI governance can no longer sit outside IAM design.
NHIMG editorial — based on content published by BigID: Zero Trust Data Security: Protect Sensitive Data in a Connected World
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams implement Zero Trust for NHIs and AI systems?
A: Start by mapping effective access to sensitive data, not just configured permissions.
Q: Why do NHIs complicate zero trust and least privilege efforts?
A: NHIs complicate zero trust because they are numerous, persistent, and often tightly integrated into applications and pipelines.
Q: What breaks when data classification is missing from access governance?
A: Least privilege becomes too coarse to be useful.
Practitioner guidance
- Map effective access to sensitive datasets Identify who and what can actually reach high-value data through direct, inherited, and indirect entitlements.
- Classify data before tuning access policy Use sensitivity, regulatory status, and business impact to decide which datasets deserve tighter verification and shorter access lifetimes.
- Reduce standing privilege for NHIs Remove broad group memberships, stale service account rights, and inherited permissions that let machine identities browse beyond their task scope.
What's in the full article
BigID's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step breakdown of how BigID connects sensitive data to identities, permissions, and activity.
- Practical implementation examples for classifying data and mapping effective access across cloud, SaaS, and on-premises systems.
- Operational workflow detail for prioritising excessive access and triggering remediation actions.
- Use-case guidance for applying data-aware controls to AI systems and non-human identities.
👉 Read BigID's analysis of zero trust data security for identities and sensitive data →
Zero trust for AI systems and NHIs: are your controls keeping up?
Explore further
18/08/2026 3:23 pm
Zero Trust data security is now an identity governance problem, not only a network design problem. The article is right to move the discussion from perimeter trust to resource-level decisions, but the deeper point is that identity teams now own the data exposure boundary. If users, service accounts, workloads, and AI systems are all reaching the same data stores, then access governance has to treat them as one control plane. Practitioners should stop separating network trust from identity trust when sensitive data is the asset being protected.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who is accountable when a third-party identity causes data exposure?
A: Accountability sits with the organisation that trusted the identity without sufficient boundaries, not just with the vendor that used it. If a third-party account was over-scoped, persistently trusted, or insufficiently monitored, the governance failure is internal. Frameworks such as NIST CSF and zero trust both expect explicit control over external access.
👉 Read our full editorial: Zero trust data security now has to govern AI systems and NHIs
