Topic starter
16/01/2026 5:48 pm
TL;DR: Active Directory, SaaS sprawl, non-human identities, and autonomous AI agents have expanded identity into a largely invisible attack surface, while provisioning access still does not equal controlling risk, according to Silverfort. Identity security now depends on shared visibility, privilege control, and lifecycle governance across humans, machines, and agents.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “Shared responsibilities, shared outcomes: How IAM and Security teams stay in sync from AD to AI”.
Key questions
A: When identity security is scoped too narrowly, teams tend to focus on account administration while missing business continuity, crisis response, and cross platform trust relationships.
Q: Why do service accounts and AI agents increase lateral movement risk?
A: Service accounts and AI agents often operate with persistent permissions across multiple systems, which makes them useful stepping stones after compromise.
Q: How do organisations know if privileged access controls are working?
A: They are working when standing privilege declines, privileged sessions are shorter, and elevated access is granted only when needed.
Practitioner guidance
- Build a unified identity inventory Include human users, service accounts, API keys, cloud identities, SaaS accounts, and AI agent credentials in one inventory with ownership and usage context.
- Re-tier privileged access by actual use Rank privileged identities by authentication activity, business criticality, and reachability instead of relying on what the PAM vault already knows.
- Create shared IAM and security workflows Define joint processes for alert enrichment, incident escalation, and lifecycle events so security sees abuse patterns and IAM can close control gaps.
Bottom line: Identity security has outgrown the IAM-only model because hybrid estates now mix human accounts, service identities, SaaS access, and AI-driven credentials.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 7:59 am
Shared identity control is now the baseline, not a collaboration nice-to-have: IAM governs access creation, but security governs exposure, abuse detection, and blast-radius reduction. In hybrid estates those functions cannot be separated cleanly because the same identity object can exist across on-prem, cloud, SaaS, and agent workflows. Practitioners should treat identity security as a joint operating model, not a handoff.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable when identity risk spans IAM and security operations?
A: Both teams, but with different responsibilities. IAM owns identity context, ownership, and lifecycle state, while security owns abuse detection, threat correlation, and containment. When those functions stay separate, no one has a complete picture of who or what can actually move through the environment.
👉 Read our full editorial: Identity security in the AI era needs shared control, not IAM alone