Topic starter
22/01/2026 4:49 pm
TL;DR: Traditional IGA platforms struggle to govern thousands of human and machine identities across APIs, AI tools, and automated workflows, leaving many organisations unable to see half their identity landscape and exposing a longer window for abuse, according to Omada Identity. Legacy identity governance now creates both security risk and operational drag; modernisation is an access-control and resilience issue, not a tooling refresh.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Why Identity Governance Modernization Can't Wait”.
Key questions
Q: What breaks when identity governance does not cover AI agents and service accounts together?
A: Governance breaks at the boundary between approved access and actual execution.
Q: Why does delayed discovery create more security risk in modern IGA?
A: Because automated identities can be created and used well before the next scheduled review.
Q: What are the signs that legacy IGA is no longer keeping up?
A: Common signs include unknown service accounts, AI tools with undocumented API access, manual reconciliation after audits, and review cycles that routinely find access long after it was granted.
Practitioner guidance
- Inventory non-human identity creation paths Map every place where AI tools, scripts, containers and workflows create service accounts, API keys, tokens or certificates.
- Shift recertification toward continuous discovery Use event-driven discovery and change monitoring so new identities and access changes are surfaced as they happen instead of waiting for quarterly review cycles.
- Tie every API-authenticated workflow to an owner Require business ownership, approval evidence and revocation criteria for each API-backed workflow, especially where AI tools and automation inherit access through shared credentials.
Bottom line: Legacy identity governance struggles most where automation creates access outside its visibility model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 10:31 am
Legacy IGA is no longer a complete control boundary. The article describes a world where business teams create access through APIs, AI tools and automation faster than governance systems can inventory it. That means identity governance is now a discovery problem as much as a certification problem. Practitioners should treat unseen non-human identities as ungoverned attack surface, not administrative noise.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations turn compliance risk management into identity governance control?
A: Start by mapping each compliance requirement to a concrete identity control such as access review, revocation, monitoring, or lifecycle ownership. Then define the evidence that proves the control worked in practice. If the programme cannot show who approved access, who removed it, and when, compliance is only partially managed.
👉 Read our full editorial: Identity governance modernization is now a security requirement