Topic starter
16/01/2026 11:01 am
TL;DR: Enterprises are operating with an incomplete view of their identity attack surface, even as they manage an average of 50 non-human identities per employee across clouds, SaaS, and AI systems, according to Permiso Security. The visibility gap is now a structural IAM problem because you cannot govern, detect, or respond to identities you have not inventoried.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “Comprehensive Identity Visibility and Intelligence with Permiso Discover”.
Key questions
Q: What breaks when organisations do not have visibility into identity behavior and entitlements?
A: Without visibility into behavior and entitlements, teams lose the ability to distinguish normal access from suspicious activity.
Q: Why do incomplete identity inventories create access risk?
A: Because every downstream control assumes the inventory is accurate.
Q: How do you know if identity visibility is actually improving security?
A: Visibility is only improving security if it leads to fewer uncontrolled access paths and more decisions enforced at the point of use.
Practitioner guidance
- Establish continuous identity discovery Inventory humans, service accounts, API keys, machine identities, and AI agents across cloud, SaaS, identity providers, and CI/CD pipelines with continuous updates instead of periodic scans.
- Map identity relationships and reachability Document direct and indirect access paths, federated trust links, and privilege escalation routes so you can see who can reach production data through each identity.
- Assign explicit ownership for every identity type Tie each identity to a named business or technical owner and make offboarding, rotation, and access review dependent on that ownership record.
Bottom line: The article argues that identity visibility is the missing prerequisite for effective NHI governance, because control systems cannot manage identities they cannot enumerate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:32 am
Identity visibility is now a control plane problem, not a reporting problem. When organisations cannot see all humans, NHIs, and AI identities in one place, every downstream control inherits that blindness. Detection, response, least privilege, and compliance all depend on an inventory that is current enough to trust, so visibility has to sit at the front of the programme.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams prioritise identity visibility before detection and response?
A: Yes, because detection and response depend on knowing which identities are legitimate and which ones are out of scope. Without that baseline, security teams cannot separate normal automation from shadow identities, or active risk from stale records. Visibility is the prerequisite control that makes downstream monitoring and containment credible.
👉 Read our full editorial: Identity visibility is the missing layer in NHI security programmes