Topic starter
16/04/2026 7:56 pm
TL;DR: Identity sprawl is turning zero trust into a governance problem as federal and regulated organisations add human, machine, service, developer, and AI identities, according to Delinea. Identity programmes have to sustain continuous verification and least privilege across a much larger attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Meeting federal zero trust mandates amid exploding identity risk”.
By the numbers:
- 86% of breaches involve compromised privileged credentials, according to the Delinea article citing Verizon DBIR 2023.
- 71% increase in attacks using valid credentials year-over-year, according to the Delinea article citing IBM X-Force Threat Intelligence Index 2024.
- Over 80% of hacking-related breaches involve stolen or weak passwords, according to the Delinea article citing ITGlue password rotation research.
Key questions
Q: Why do valid credentials still create so much risk in zero trust environments?
A: Because a credential can be valid and still be unsafe if it has more privilege than the current task requires.
Q: How can security teams tell whether their identity programme is ready for zero trust?
A: Teams are closer to zero trust when they can verify identity continuously, limit standing access, and revoke privileges quickly across the full lifecycle.
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Practitioner guidance
- Map the full identity estate Build an authoritative inventory of human, machine, service, developer, and AI identities, then reconcile it against active entitlements and authentication paths.
- Reduce standing privilege exposure Review privileged accounts and service identities for access that persists beyond task need, especially where credentials can be reused or replayed.
- Correlate identity signals across tools Link IAM, PAM, and security telemetry so authentication, privilege changes, and anomalous use are visible in one operational view.
Bottom line: Identity sprawl is now a control problem, not just a scaling problem, because the number and variety of identities can outrun the architecture meant to govern them.
Glossary terms: Identity Sprawl, Identity Blast Radius, Continuous Verification, Standing Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 16 hours ago by NHI Mgmt Group
11/10/2026 2:39 am
Identity sprawl is now the limiting factor in zero trust. Zero trust assumes that the identity surface is knowable, continuously verifiable, and governable. That assumption weakens when organisations manage millions of identities across humans, machines, developers, service accounts, and AI systems, because the control problem shifts from policy design to identity inventory fidelity. Practitioners should treat identity sprawl as a programme constraint, not a background condition.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: How should agencies respond when identity tools are fragmented across the stack?
A: They should treat fragmentation as an architecture defect, not a tooling preference. The goal is one identity control plane that correlates access, privilege, and activity across IAM, PAM, and adjacent systems, because isolated tools leave blind spots that attackers can exploit.
👉 Read our full editorial: Federal zero trust mandates collide with identity risk sprawl