Topic starter
23/03/2026 3:30 pm
TL;DR: 3.8% of surveyed organisations avoided an identity-related incident last year, while 64.6% saw three or more incident types and 88.7% say AI and automation are necessary to keep up, according to Lumos' AI, Automation, and Risk in 2026 research. Manual identity governance is now a scaling problem, not just an efficiency problem, and the trust gap around autonomous decisions is widening.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “Identity is at a Breaking Point”.
By the numbers:
- Only 3.8% of organisations made it through the last year without an identity-related security incident, according to Lumos.
- Nearly 65% of companies, or 64.6%, saw three or more different kinds of identity-related incidents in the last 12 months, according to Lumos.
- 46% already have at least one machine identity for every three humans, according to Lumos.
Key questions
Q: What breaks when identity review is still manual in environments with many machine identities?
A: Manual review breaks when the number of service accounts, APIs, and AI-driven identities grows faster than the team can verify ownership, purpose, and necessity.
Q: Why do stale entitlements create so much identity risk?
A: Stale entitlements extend access beyond the period when it is actually needed, which gives attackers more time and more privilege to work with.
Q: What are the signs that machine identity governance is no longer keeping up?
A: Common signs include surprise certificate expirations, repeated manual renewals, inconsistent policy enforcement, and teams that cannot answer who owns a given key or trust anchor.
Practitioner guidance
- Prioritise machine identity inventory Build a complete inventory of service accounts, API credentials, and AI-linked identities before attempting broader automation.
- Reduce reviewer context gaps Enrich access review workflows with last-used data, ownership, and business justification so approvers are not forced to certify blind.
- Target dormant access and stale entitlements Treat accounts inactive for more than 90 days, especially privileged or machine identities, as active attack paths that need suppression, not just periodic review.
Bottom line: The article argues that machine identity growth is overwhelming manual governance, especially where reviewer context and ownership data are incomplete.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 6:17 am
Machine identity scale has outgrown human-paced governance. The core problem is not simply that there are more identities, but that the identity estate is changing faster than reviewers can understand and approve it. When one human hire can imply many dependent machine identities, the control model needs inventory, ownership, and lifecycle precision that manual review does not naturally deliver. Practitioners should treat scale itself as a governance defect when review quality falls behind.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- The 2025 Gartner Machine Identity Management in a Hybrid, Automated AI World Survey showed that 32% of organizations use mostly automated methods to manage credentials and only 1% use fully automated methods.
A question worth separating out:
Q: Should organisations move some identity decisions closer to runtime or issuance time?
A: Yes, when the identity can act quickly enough that a later review will not capture the relevant state. That is especially true for dynamic machine identities and autonomous workflows. Issuance-time controls and runtime guardrails are more effective than relying on a certification cycle to notice abuse after the access has already been consumed.
👉 Read our full editorial: Identity at a breaking point as machine identities outpace control