Topic starter
12/06/2026 12:43 am
TL;DR: RSA 2025 conversations highlighted a widening gap between AI-driven identity governance aspirations and the reality of machine identity sprawl, with 45:1 machine-to-human ratios and 60%+ shadow IT visibility issues shaping the discussion, according to Zluri. The governance problem is no longer review volume alone; it is that legacy IAM controls were built for human directories, not fast-moving non-human identity estates.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “AI and Identity Governance: What We Learned at RSAC 2025”.
By the numbers:
- 2025 is the year when machine identities outnumber humans by 45:1.
- Over 60% of IT resources in a typical organisation exist as either unmanaged or shadow IT.
Key questions
Q: How should security teams govern machine identities differently from human users?
A: Security teams should govern machine identities with lifecycle, context, and runtime controls, not human approval workflows.
Q: Why do periodic access reviews miss the real NHI risk?
A: Periodic reviews miss the real risk because they measure entitlement state at a point in time, while NHI exposure can change between cycles.
Q: What breaks when AI agent access is reviewed only after the fact?
A: After-the-fact review leaves a gap between action and containment.
Practitioner guidance
- Map machine identity inventory coverage Measure how completely your IGA stack sees service accounts, certificates, keys, access tokens, and AI agents across SaaS, cloud, and internal applications.
- Separate review logic for human and non-human identities Do not run the same certification workflow for employees and non-human identities.
- Tie access approval to activity evidence Require runtime usage signals before recertifying sensitive entitlements in SaaS-heavy environments.
Bottom line: The article argues that machine identity sprawl has overtaken human-centric identity governance assumptions, especially in SaaS-heavy environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:09 am
Machine identity sprawl is now the primary governance problem, not a side effect of cloud growth. Zluri’s RSA readout points to a market where non-human identities have outgrown the human-centric controls still used to manage them. That matters because the control plane is being asked to govern a population whose size, volatility, and ownership model no longer resemble the assumptions behind classic IGA. Practitioners should treat machine identity inventory as the first order governance problem.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations prioritise discovery or remediation first for NHI sprawl?
A: Discovery should come first, because remediation depends on knowing which identities exist, where they live, and which ones are actually active. Without complete visibility, remediation workflows can remove the wrong access while leaving the highest-risk identities untouched.
👉 Read our full editorial: AI-driven identity governance is colliding with NHI sprawl
This post was modified 4 days ago by NHI Mgmt Group