Topic starter
24/06/2026 11:18 pm
TL;DR: Identity visibility collapsed from 93% in 2024 to 46% in 2025 in Permiso Security’s 2026 State of Identity Security Report, while 92% of organisations already have AI agents accessing production or sensitive data and 95% say those systems can create or modify identities without traditional oversight. The programme failure is no longer inventory quality but real-time visibility into who or what is acting.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “Permiso State of Identity Security Report 2026: From False Confidence to True Visibility”.
By the numbers:
- Comprehensive identity visibility fell from 93% in 2024 to 46% in 2025.
- 92% already have AI agents accessing production or sensitive data.
- 95% said AI systems could create or modify identities without traditional human oversight.
Key questions
Q: What breaks when identity visibility stops at inventory?
A: Inventory without attribution leaves teams unable to tell which accounts, entitlements or non-human identities still have a valid business purpose.
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Separate inventory from visibility in your IAM programme Define inventory as a discovery output and visibility as a runtime control outcome.
- Map AI agent identity creation to approval boundaries Identify every place where AI systems can create or modify identities, tokens, or permissions without a human approval workflow.
- Unify identity telemetry across core platforms Correlate IdP authentication data, cloud identity data, and SIEM access events into one operational view so permission scope and activity can be analysed together instead of in separate tools.
Bottom line: The report shows a growing gap between perceived identity control and actual runtime visibility across cloud environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:04 am
Visibility is now the primary control plane for identity security. The report shows a sharp drop in confidence because organisations are finally measuring what they can actually observe, not what they assume exists. That shift matters across human, NHI, and agentic programmes because a static inventory never told the whole story about runtime access. The practitioner conclusion is simple: if you cannot see identity behaviour in motion, you do not have control.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What should organisations do when service accounts keep accumulating after systems change?
A: They should connect discovery to offboarding so stale service accounts, API keys, and tokens are not left active after the application or owner changes. The issue is not just accumulation, but continued successful authentication. Lifecycle closure needs to be a live control, not a periodic clean-up exercise.
👉 Read our full editorial: Identity visibility fell sharply as AI agents expand access