Topic starter
22/09/2026 3:43 pm
TL;DR: Machine identities now outnumber human identities 109:1, and Linx Security cites research showing only 44% of organisations have policies to manage AI agents even as 92% say governance is critical. The governance gap is no longer theoretical: identity data, ownership, lifecycle, and least-privilege controls have to be redesigned for human, non-human, and agentic identities together.
Editorial analysis by NHI Mgmt Group, based on content published by Linx Security: “The Identity Landscape Changed. Your IGA Needs to Catch Up.”.
By the numbers:
- Machine identities now outnumber human identities 109:1, according to Palo Alto Networks' 2026 Identity Security Landscape cited by Linx Security.
Key questions
Q: How should security teams govern machine identities in industrial environments?
A: Security teams should govern machine identities the same way they govern privileged access: assign an owner, define a specific purpose, limit scope, and review it continuously.
Q: Why do periodic access reviews miss excessive access in modern IGA programmes?
A: Because access often drifts between review cycles.
Q: What breaks when identity data is fragmented across HR, directory, and application systems?
A: Fragmented identity data creates blind spots in access governance.
Practitioner guidance
- Build a unified identity graph Correlate identities, accounts, entitlements, ownership, usage, and lifecycle state across HR, IdP, SaaS, cloud, and engineering sources before expanding governance automation.
- Assign explicit owners to non-human identities Create accountable ownership for service accounts, workloads, API keys, and AI agents, and separate that ownership from technical administration rights.
- Operationalize continuous least privilege Review stale, unused, excessive, or orphaned access continuously, with special attention to standing privilege and permissions that outlast the business need.
Bottom line: Machine identities and AI agents now force IGA to govern a far larger estate than workforce identity alone, and the old review-led model no longer provides enough context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
22/09/2026 3:43 pm
Identity governance is now a graph problem before it is a workflow problem. When identities, accounts, entitlements, ownership, and usage are scattered across HR, IdP, SaaS, and cloud systems, governance decisions lose the context they need to be meaningful. The programme failure is not merely incomplete visibility. It is the inability to connect access to accountable ownership and current business purpose. Practitioners should treat correlation as the first governance control.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between access administration and ownership in IGA?
A: Administration is the ability to change permissions. Ownership is accountability for whether those permissions are appropriate for the business purpose. In modern IGA, those are not the same role, and treating them as the same is one of the fastest ways to lose control of non-human and delegated access.
👉 Read our full editorial: Identity governance must shift for machine identities and AI agents
This post was modified 2 days ago by NHI Mgmt Group