Topic starter
16/01/2026 12:43 pm
TL;DR: Clarity Security says non-human identities have reached a 144:1 ratio, up 44% from 2024 to 2025, while AI-driven cyber attacks rose 47% globally and 78% of CISOs said the threat materially affected business outcomes. Manual, ticket-heavy IAM is losing its ability to govern NHIs, AI agents, and context-driven access at enterprise speed.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “5 IAM Trends to Watch in 2026”.
Key questions
Q: What breaks when non-human identities are managed outside the IAM operating model?
A: What breaks is accountability.
Q: Why do unmanaged NHIs increase security risk even when no breach has occurred?
A: Because risk accumulates in standing privilege, forgotten accounts, and over-broad access scopes.
Q: How should security teams evaluate identity security platforms when NHI governance is in scope?
A: They should look for coverage across discovery, ownership, lifecycle control, access review, and remediation for both human and non-human identities.
Practitioner guidance
- Map every non-human identity to an owner Build an inventory that ties each service account, bot, application identity, and AI agent to a business owner, technical owner, and environment.
- Replace ticket-heavy review cycles with continuous monitoring Use alerting and drift detection to surface new identities, entitlement expansion, and dormant high-risk access as they appear rather than waiting for the next certification round.
- Standardise application onboarding requirements Require new applications and agents to meet identity, logging, and access-scoping standards before they are approved for production use.
Bottom line: The article describes a structural governance gap: identity sprawl is growing faster than manual IAM processes can review, certify, or remove access.
What's in the full article
Clarity Security's full blog post covers the operational detail this post intentionally leaves for the source:
- The article's full discussion of the 144:1 NHI ratio and how Clarity Security uses it to frame 2026 identity risk
- Specific operational recommendations for unified governance across cloud, hybrid, and on-premise identity estates
- The article's examples of deep entitlement reviews, continuous monitoring, and standardisation for new app adoption
- The full explanation of why identity is treated as a strategic business enabler, not only a security control
👉 Read Clarity Security's analysis of AI agent and NHI growth outpacing manual IAM governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 6:07 pm
Manual IAM is no longer a viable control model for machine-scale identity growth. The governance problem is not simply volume, but the mismatch between human-paced workflows and machine-paced identity creation. Service accounts, bots, and AI agents can multiply faster than access review and offboarding processes can absorb them. The consequence is a control plane that records identity activity after the fact instead of governing it at issuance time, which means practitioners must rethink manual governance as a scaling limit rather than a process preference.
A question worth separating out:
Q: Should organisations prioritise context-aware access over static role assignment for NHIs?
A: Yes, when identities operate in dynamic environments where task, device, or location change the trust profile. Static assignment works poorly for NHIs that need narrow, temporary, or environment-specific access. Context-aware policy is better when the main problem is limiting unnecessary standing privilege without slowing legitimate work.
👉 Read our full editorial: AI agent and NHI growth is outpacing manual IAM governance