TL;DR: Most enterprise identities are now non-human, and recent studies cited by Identra show machine identities outnumber human ones by tens to more than 100 per person; the article argues that inventory, vaulting, and posture scanning do not answer who acted, with what authority, and on whose behalf. The governance gap is structural, because machine authority can outlive ownership, context, and runtime visibility.

NHIMG editorial — based on content published by Identra.ai: The Non-Human Majority

By the numbers:

• Recent industry studies report tens to more than 100 machine identities per human, depending on what is counted and the environment measured.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: How should security teams govern machine identities in industrial environments?

A: Security teams should govern machine identities the same way they govern privileged access: assign an owner, define a specific purpose, limit scope, and review it continuously.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation.

Q: What breaks when organisations cannot see all of their non-human identities?

A: What breaks is governance itself.

Practitioner guidance

• Separate principal, credential, grant, runtime, resource, and owner Stop treating a secret as the identity itself.
• Map reachable blast radius, not just inventory counts Model effective paths from each machine identity to sensitive APIs, datasets, and automation targets.
• Bind lifecycle controls to every non-human principal Require explicit creation, ownership, renewal, and retirement for service accounts, tokens, and agent identities.

What's in the full article

Identra.ai's full article covers the operational detail this post intentionally leaves for the source:

• The article's six-object identity model and the practical distinction between principal, credential, grant, runtime, resource, and accountability context.
• The full argument for why machine identities break human IAM assumptions across lifecycle, context, and runtime speed.
• The complete conceptual model for reachability and blast radius, including the relationship between potential, effective, and observed access.
• The closing operational framework for resolving every identity fragment back to one accountable control plane.

👉 Read Identra.ai's analysis of the non-human majority and identity accountability →

Non-human identity sprawl: what IAM teams are missing?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: At Gartner SRM 2026, the recurring themes were that AI and automation are strengthening defenders, vulnerability exploitation has overtaken credential abuse as the top initial access vector at 31% of breaches, and identity-first microsegmentation is becoming the practical answer for mixed IT, OT, and unmanaged environments, according to Elisity. The governance lesson is that visibility, identity, and enforcement now have to move together, or segmentation becomes a theory rather than a control.

NHIMG editorial — based on content published by Elisity: Field Notes from Gartner SRM 2026: Four Threads I'm Still Thinking About

By the numbers:

• credential abuse, the previous leader, dropped to 13 percent.
• Full remediation of CISA Known Exploited Vulnerabilities dropped to 26 percent this year.

Questions worth separating out

Q: How should security teams implement identity-first microsegmentation in hybrid environments?

A: Start by anchoring policy to identity sources, asset type, and operational criticality, not to IP ranges alone.

Q: Why do mixed IT and OT environments break traditional segmentation assumptions?

A: Because IT and OT share neither the same tolerance for failure nor the same control objective.

Q: What should organisations measure before expanding segmentation programmes?

A: Measure what assets exist, who can reach them remotely, and which externally exposed systems still lack authentication.

Practitioner guidance

• Define identity-based segmentation boundaries Map policies to verified users, devices, and workloads, then test where network-only rules fail in legacy and OT segments.
• Make visibility a measurable control objective Track what assets exist, who is remoting into them, and which internet-facing systems lack authentication.
• Separate IT and OT enforcement logic Keep policy, management, and enforcement distinct where a false positive could interrupt care or production.

What's in the full article

Elisity's full field note covers the operational detail this post intentionally leaves for the source:

• The specific conference themes and hallway observations that shaped the four threads in the article
• The exact analyst and keynote framing behind the defender economics argument
• More detail on the identity-first microsegmentation examples from healthcare, manufacturing, and critical infrastructure
• The vendor-comparison context behind the consolidation and complexity-reduction discussion

👉 Read Elisity's field notes from Gartner SRM 2026 on identity, automation, and segmentation →

Identity-first microsegmentation: what security teams are missing?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: Healthcare breach costs reached $7.42 million per incident for the 14th consecutive year, while stolen credentials remained the top initial access vector and legacy systems continued to block patching and monitoring, according to IBM, Verizon, and HIMSS. The real control question is no longer prevention alone, but how identity scopes, segmentation, and lifecycle governance limit what an attacker can reach after entry.

NHIMG editorial — based on content published by Elisity: Reducing the Blast Radius: A Cybersecurity Summit Boston Recap

By the numbers:

• Healthcare led every other industry in breach cost for the 14th consecutive year, at an industry average of 7.42 million dollars per incident.

Questions worth separating out

Q: How should healthcare teams reduce blast radius after an identity compromise?

A: Healthcare teams should reduce blast radius by segmenting access around identity, not just around network location.

Q: Why do legacy devices make identity governance harder in hospitals?

A: Legacy devices make identity governance harder because they often cannot support MFA, frequent patching, or modern telemetry, yet they still sit on networks with valuable systems.

Q: What breaks when AI agents are not treated as identities?

A: What breaks is the assumption that only people and traditional service accounts can create meaningful access paths.

Practitioner guidance

• Map identity blast radius for critical clinical systems Identify which human users, service accounts, vendors, and AI-connected workloads can reach each high-value device or application, then remove unnecessary cross-zone paths and shared access patterns.
• Replace broad network trust with identity-scoped allow-lists Use microsegmentation policies that bind access to the minimum identity set needed for a task, especially where legacy devices cannot support modern authentication or patching.
• Force vendor access through controlled privileged gateways Eliminate direct remote administration paths and require all third-party maintenance to pass through monitored jump boxes, MFA-backed gateways, and session logging.

What's in the full article

Elisity's full blog post covers the operational detail this recap intentionally leaves for the source:

• Session-by-session recap of the Boston summit and the speakers' specific examples from healthcare and AI governance
• The detailed segmentation patterns discussed for legacy medical devices, vendor access, and internal administrative pathways
• The panel's discussion of AI agents, third-party identity boundaries, and post-quantum readiness
• The surrounding summit context and how the speakers tied identity to business resilience

👉 Read Elisity's recap of reducing the blast radius at Cybersecurity Summit Boston →

Reducing the blast radius in healthcare networks and AI identity?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: AI agents are increasingly influencing or placing ecommerce orders, but today’s liability-shift mechanisms still assume a human cardholder and a stable authentication flow, according to Signifyd. That mismatch means merchants need controls that distinguish legitimate agent-led orders from fraud without adding avoidable checkout friction.

NHIMG editorial — based on content published by Signifyd: Payment liability shift: What merchants should know

By the numbers:

• 36% of UK consumers surveyed by Signifyd said they couldn’t complete a transaction because of 3DS-powered SCA.
• 36% of U.S. online shoppers said that they stopped patronizing a merchant after having an order declined for no apparent reason, according to Signifyd.
• 3% of orders in the U.S. are subject to 3DS, according to Datos Research.

Questions worth separating out

Q: How should merchants handle liability shift when AI agents place orders on behalf of customers?

A: Merchants should treat AI agent-led orders as a distinct trust case, not as a routine extension of human checkout.

Q: Why do step-up challenges create so many false declines in ecommerce?

A: Step-up challenges often fail good orders because they rely on narrow signals such as OTPs, device familiarity, or challenge questions.

Q: What breaks when merchants rely only on authentication to approve orders?

A: Authentication alone cannot tell you whether an order is commercially trustworthy.

Practitioner guidance

• Separate authentication evidence from order approval logic Define which signals establish identity and which signals support commercial decisioning.
• Measure false declines alongside fraud losses Track how often valid customers are blocked, how often risky orders pass, and how those outcomes affect revenue and retention.
• Document AI agent order flows in the trust model Identify where an AI agent can initiate, modify, or complete a purchase, and define which identity evidence supports that path before liability is assigned.

What's in the full article

Signifyd's full post covers the operational detail this post intentionally leaves for the source:

• The distinction between EMV, 3DS, and contractual fraud guarantees in practical checkout terms.
• The mechanics of how step-up authentication creates false declines and why merchants see conversion loss.
• The specific order signals used in the vendor's decisioning model, including device, geolocation, and velocity data.
• The business logic behind liability transfer when a provider guarantees chargeback reimbursement.

👉 Read Signifyd's analysis of payment liability shift and fraud risk →

AI agent-led checkout decisions: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: Microsegmentation paired with CPS visibility is being framed as a resilience control for OT because one compromised connection can become an entire production outage, according to ColorTokens. The deeper issue is not visibility alone but whether identity and network controls can limit lateral movement before operational systems become unrecoverable.

NHIMG editorial — based on content published by ColorTokens: Operational Resilience Starts with Risk-Intelligent Microsegmentation

By the numbers:

• 50% of organisations are onboarding new vaults without proper security approval, introducing vulnerabilities and misconfigurations from the outset.

Questions worth separating out

Q: How should security teams reduce lateral movement risk in OT environments?

A: Security teams should reduce lateral movement risk by enforcing explicit communication boundaries between operational assets, not by relying on visibility alone.

Q: Why do OT and CPS environments need microsegmentation more than ordinary IT networks?

A: OT and CPS environments often contain systems that cannot be quickly patched, restarted, or recovered without operational impact.

Q: What do teams get wrong when they treat asset discovery as containment?

A: Teams get it wrong when they assume that knowing what is connected means they have reduced risk.

Practitioner guidance

• Map operational communication paths before enforcing policy Build a path-level inventory of which OT, IoT, and CPS assets talk to each other, then classify those paths by business criticality and recovery impact.
• Prioritise segmentation by blast radius, not by asset count Rank segmentation work by the systems whose compromise would stop production, threaten safety, or block recovery.
• Simulate policy changes before enforcement Test new allow and deny rules in a staging or simulation workflow before pushing them into live operational environments.

What's in the full article

ColorTokens's full post covers the operational detail this post intentionally leaves for the source:

• The integration brief showing how Claroty xDome context is mapped into segmentation policy decisions.
• Examples of OT and IoT asset attributes that improve communication-path analysis before enforcement.
• The list of SIEM, SOAR, EDR, and vulnerability integrations used to enrich segmentation context.
• How Gatekeeper extends agentless enforcement to legacy and unpatchable systems.

👉 Read ColorTokens's post on risk-intelligent microsegmentation for OT resilience →

Risk-intelligent microsegmentation for OT: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: As data volumes grow, legacy, vertically scaled architectures create bottlenecks, with read-heavy Command Center calls taking 30 seconds or more until a read-optimised Entity Lookup Service reduced responses to under 3 seconds, according to Commvault. The architectural shift matters because identity and access controls for modern platforms must now assume distributed services, independent scaling, and a centralized control plane.

NHIMG editorial — based on content published by Commvault: an architectural analysis of horizontal scaling, microservices, and the Global Command Center

By the numbers:

• Some API calls were taking 30 seconds or more to respond.

Questions worth separating out

Q: How should teams govern identity and access in horizontally scaled platforms?

A: Teams should treat horizontal scaling as a governance redesign, not a capacity upgrade.

Q: Why do microservices change the way IAM teams think about platform risk?

A: Microservices change risk because they distribute responsibility across more services, more interfaces, and more execution paths.

Q: What breaks when a control plane becomes the only way to manage the environment?

A: What breaks is resilience and governance at the same time.

Practitioner guidance

• Map single-instance governance dependencies Identify where one server, one console, or one admin workflow still carries multiple operational responsibilities.
• Separate read-heavy administrative queries Move high-volume visibility requests onto a read-optimised path so operational teams can inspect state without fighting transactional workloads.
• Standardise shared services across microservices Make authentication, logging, error handling, and request lifecycle management common services rather than per-team reinventions.

What's in the full article

Commvault's full article covers the architectural detail this post intentionally leaves for the source:

• The evolution from vertical to horizontal scaling across MediaAgents and core platform services.
• How the Entity Lookup Service uses a denormalized data model to improve command-center read performance.
• How the CVDotnetContainer standardizes authentication, logging, error handling, and service hosting.
• Why the Global Command Center changes administration across distributed CommCell environments.

👉 Read Commvault's analysis of horizontal scaling and the Global Command Center →

Horizontal scaling and control planes: what it means for IAM teams?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: Vishing calls rose 449% in 2025 as organised groups industrialised help-desk impersonation, then pivoted from compromised human accounts to persistent machine identities such as OAuth tokens and service accounts, according to Commvault. The governance failure is not just initial access but the lack of lifecycle, visibility, and rollback control over NHIs once attackers move into the machine layer.

NHIMG editorial — based on content published by Commvault: vishing attacks, machine identity persistence, and identity resilience

By the numbers:

• 449% in 2025., g, or vishing, jumped 449% in 2025.
• The service accounts, API keys, and OAuth tokens that now outnumber human users by 144 to 1.
• 25% of organizations have formal policies for creating, or creating or decommissioning NHIs.

Questions worth separating out

Q: What breaks when help desk compromise is not linked to NHI governance?

A: The response process stops at the human account, while attackers move persistence into OAuth tokens, service accounts, and other machine identities.

Q: Why do vishing attacks so often lead to long-lived access?

A: Because help desk resets can create new access paths faster than teams can observe them, and the resulting machine identities do not behave like employee logins.

Q: How can security teams tell whether identity resilience is actually working?

A: Look for evidence that unauthorized privilege changes are detected, contained, and rolled back before persistence is established.

Practitioner guidance

• Correlate help desk actions with identity state changes Flag password resets, MFA resets, and account recovery events when they are immediately followed by new token creation, service account provisioning, or privilege escalation.
• Inventory and classify all NHIs touched by user recovery workflows Map which recovery processes can create or modify OAuth tokens, API keys, service accounts, and administrative machine identities.
• Separate human remediation from NHI remediation When a human account compromise is confirmed, run a second workstream for non-human identities that may have been minted, inherited, or exposed during the attack.

What's in the full article

Commvault's full article covers the operational detail this post intentionally leaves for the source:

• The help desk fraud pattern and the specific callback, verification, and out-of-band checks the vendor recommends.
• The identity resilience workflow for detecting and rolling back unauthorized privilege changes after a vishing event.
• The practical correlation signals between MFA resets, token creation, and machine identity escalation.
• The vendor's framing of machine identities as Tier 0 assets and the associated response sequence.

👉 Read Commvault's analysis of vishing-driven identity compromise and NHI persistence →

Vishing, OAuth tokens, and service accounts: where identity controls fail?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: Its FY25 climate work reduced Scope 2 emissions by over 13% and improved emissions intensity from 12.7 to 9.6 metric tons CO2e per million USD revenue, according to Commvault. The governance signal is that sustainability metrics are now part of operational resilience, not separate from it, while linking cloud efficiency and resilience to broader sustainability goals.

NHIMG editorial — based on content published by Commvault: climate action, resilience, and sustainability progress

By the numbers:

• Scope 2 emissions dropped by over 13% in FY25, according to Commvault.
• Emissions intensity fell from 12.7 to 9.6 metric tons CO2e per million USD revenue, according to Commvault.

Questions worth separating out

Q: Why should security teams care about sustainability governance?

A: Security teams should care because sustainability governance often reveals whether an organisation can measure, own, and reduce operational waste across critical systems.

Q: How does workload efficiency affect governance quality?

A: Workload efficiency affects governance quality by reducing the number of unnecessary systems, dependencies, and exceptions that teams must monitor.

Q: What does formal climate disclosure tell practitioners about accountability?

A: Formal climate disclosure tells practitioners that governance becomes credible only when ownership, measurement, and reporting are explicit.

Practitioner guidance

• Map efficiency metrics to governance ownership Tie emissions intensity, storage usage, and workload efficiency to named owners in the same way you would assign accountability for IAM or NHI controls.
• Review infrastructure sprawl as a control issue Identify duplicated storage, redundant workloads, and underused services that increase both operational cost and governance complexity.
• Align resilience reporting with formal disclosure discipline If your organisation already reports against a framework such as TCFD, bring security and platform governance teams into the same reporting cadence so operational claims can be validated consistently.

What's in the full article

Commvault's full article covers the sustainability and climate-governance detail this post intentionally leaves for the source:

• The specific FY25 sustainability metrics and the operational changes behind them.
• The discussion of LEED-certified headquarters features and facilities choices.
• The collaboration context around the Net Zero Institute and climate accountability.
• The article's own framing of how data efficiency supports resilience outcomes.

👉 Read Commvault's climate action post on data resilience and sustainability →

Climate resilience and data operations: what IAM teams should notice?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: Security and technology trends are converging on a single point: identity is becoming the control plane for AI systems, trusted access abuse, and operational resilience, according to Imprivata’s analysis. The practical shift is away from broad experimentation and toward governed permissions, continuous verification, and tighter lifecycle control across human and machine identities.

NHIMG editorial — based on content published by Imprivata: Breaking down recent security and technology trends and what they reveal about the future of identity, access, and risk

By the numbers:

• 85% of hospitals experienced vendor-related disruptions over the past year.
• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps.

Questions worth separating out

Q: How should security teams govern AI systems that can access enterprise data and workflows?

A: Treat those systems as governed identities, not just applications.

Q: Why do valid credentials create such a large attacker advantage?

A: Because they let attackers blend into normal activity.

Q: What breaks when identity continuity is not part of resilience planning?

A: Access recovery becomes as fragile as the outage itself.

Practitioner guidance

• Map AI system permissions before production use Inventory every AI-connected workflow that can read data, call tools, or trigger actions.
• Reduce the value of valid credentials Shift detection and control design toward session behaviour, privilege scope, and token persistence.
• Stress-test identity continuity during disruption Run outage exercises that include emergency access, third-party dependencies, and approval bottlenecks.

What's in the full article

Imprivata's full blog post covers the operational detail this post intentionally leaves for the source:

• Specific discussion of how AI systems are changing enterprise governance priorities as digital workers.
• The healthcare and public-sector disruption signals that underpin the resilience argument.
• The incident patterns behind token theft, persistence, and trusted access abuse across modern environments.
• The article's broader framing of security maturity, modernization, and operational readiness.

👉 Read Imprivata's analysis of AI identity oversight, healthcare resilience, and trusted access risk →

AI identity oversight and trusted access: what should IAM teams change?

Explore further

View Full Forum →  |  NHI Foundation Course →

TL;DR: Digital twins let telecom operators simulate, test, and optimise network behaviour across fixed and mobile environments, while the article says real-time data accuracy, legacy systems, and fragmented inventories still limit results. The governance issue is not simulation quality alone, but whether operators can trust the data model behind automation and autonomous network decisions.

NHIMG editorial — based on content published by Comarch: digital twins in telecom network operations and planning

Questions worth separating out

Q: How should telecom teams govern automated network changes generated by a digital twin?

A: Treat the twin as a decision-support system until its outputs have been validated against authoritative inventory and failure conditions.

Q: Why do fragmented inventories undermine digital twin accuracy?

A: A digital twin depends on a consistent source of truth for topology, configuration, and asset relationships.

Q: When should operators trust a digital twin enough to support autonomous network operations?

A: Only when the twin is fed by current, reconciled data and its outputs have been tested across realistic failure scenarios.

Practitioner guidance

• Establish a single authoritative network inventory Reconcile topology, configuration, and asset data before relying on a digital twin for planning or automated operations.
• Gate autonomous actions through sandbox validation Test self-healing, self-configuring, and optimisation logic in a controlled environment before any production rollout.
• Tie every model output to traceable change records Record which simulated conditions produced which network decision, then preserve the approval and execution trail for audit and incident review.

What's in the full article

Comarch's full article covers the operational detail this post intentionally leaves for the source:

• The article walks through how its OSS and network planning tools fit together across discovery, reconciliation, and configuration workflows.
• It provides more detail on how simulated network scenarios are translated into validated design changes before deployment.
• It expands on the platform's visualization features across geographical, topological, and hierarchical views of network assets.
• It also describes the sandboxed monitoring approach used to validate AI-driven responses without affecting production systems.

👉 Read Comarch's article on digital twins for telecom network planning and automation →

Digital twins in telecom: what they change for network teams?

Explore further

View Full Forum →  |  NHI Foundation Course →