Topic starter
12/02/2026 3:42 pm
TL;DR: Modern attacks now target identity rather than infrastructure, according to Lumos, and says organisations managing both human and non-human identities need visibility, least privilege, JIT access, and AI-assisted reviews because legacy governance was built for slower environments. The underlying issue is not automation itself but whether access still has clear accountability, revocation, and review points.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “The Future of Identity Is Autonomous — and It Starts Now”.
Key questions
Q: What breaks when service accounts are not centrally governed?
A: When service accounts are created and maintained outside a central identity process, ownership, purpose, and retirement become unclear.
Q: Why do standing NHI permissions increase operational risk?
A: Standing permissions enlarge the window in which any credential can be reused, misrouted, or overexposed.
Q: What are the signs that NHI governance is failing in an enterprise?
A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys.
Practitioner guidance
- Map all service accounts and bots to named owners Create an inventory that links each non-human identity to a business owner, technical steward, and revocation path so accountability is not ambiguous when access changes.
- Reduce standing privilege on high-value NHI accounts Replace persistent broad entitlements with task-scoped access and expiry where the workload does not require continuous permission.
- Use Just-in-Time controls for elevated access Reserve elevation for time-bound tasks and ensure the grant expires automatically once the task or session is complete.
Bottom line: Modern identity attacks succeed when valid credentials provide direct access and governance cannot keep pace with who or what holds them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 months ago by NHI Mgmt Group
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:32 pm
Identity governance is now the control plane for both human and non-human access. Lumos is right to frame identity, not infrastructure, as the centre of modern attack paths. When valid credentials are enough to reach valuable systems, the governance question becomes who or what is entitled to act, for how long, and with what revocation path. Practitioners should treat identity governance as a runtime security function, not a back-office certification process.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should teams prioritise JIT access over persistent access for NHIs?
A: Prioritise JIT access when the workload needs elevated rights only for a task, a deployment, or a short troubleshooting window. Persistent access is harder to justify when the entitlement exists mainly for convenience rather than continuous operation, because the extra exposure rarely buys equivalent value.
👉 Read our full editorial: Autonomous identity still depends on governance for NHI access