Topic starter
22/06/2026 1:41 pm
TL;DR: Traditional IAM tools miss most non-human identities because they track credentials and silos, not the identities, owners, and relationships that create real risk, according to SPHERE Technology Solutions and Gartner. That blind spot becomes more dangerous as service accounts, orphaned identities, and AI agents multiply faster than manual governance can keep up.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “Your Driver’s License Isn’t You: Understanding IVIP and the Identity Intelligence Revolution”.
Key questions
Q: Why do service accounts and machine identities matter under NIS2?
A: Service accounts and machine identities matter because they often carry the permissions that move data, trigger reports, and feed AI workflows.
Q: When does identity visibility become more important than credential management?
A: Identity visibility becomes the priority whenever the organisation cannot answer who owns an account, why it exists, or where it is used.
Q: What are the signs that service account governance is failing in an organisation?
A: Common warning signs include accounts with no clear owner, broad permissions that exceed job need, credentials stored in insecure places such as code or configuration, and service accounts that survive staff departures without reassignment.
Practitioner guidance
- Build an identity-first inventory Map every human and non-human identity to an owner, purpose, system scope, and last-used signal before trying to rationalise credentials.
- Separate identities from credentials in governance workflows Update IAM and PAM workflows so the review unit is the identity object, not the password, token, or certificate attached to it.
- Continuously discover hidden machine identities Scan application configs, scheduled tasks, scripts, database connections, and cloud automation paths to find service accounts outside directories.
Bottom line: Most organisations still govern credentials better than they govern identities, which leaves ownership and purpose blind spots across human and machine access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 1:46 pm
Identity visibility, not credential inventory, is the missing control plane: The core problem in this article is that most organisations still govern secrets, tokens, and accounts without a reliable picture of the identities behind them. That is a structural gap, because ownership, purpose, and relationship context are what make access governable. When those elements are missing, identity governance becomes reactive and incomplete. The implication is that visibility must shift from authentication artefacts to accountable identity objects.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should IAM teams govern AI agent identities differently from static service accounts?
A: IAM teams should treat AI agent identities as a separate privileged class because access can be exercised through changing tasks, tools, and contexts. That means scoping must cover tool boundaries and task purpose, not just account creation, and governance needs stronger runtime visibility than a static account model provides.
👉 Read our full editorial: Identity visibility is lagging behind machine and AI agent sprawl