How can organisations tell whether identity sprawl is getting out of control?

Why This Matters for Security Teams

identity sprawl is not just a hygiene problem. It is a control failure that hides risk in service accounts, API keys, workload tokens, and stale privileged access. When organisations cannot explain who or what has access, they lose the ability to enforce least privilege, rotate secrets reliably, or prove that access reviews are meaningful. NIST’s Cybersecurity Framework 2.0 treats visibility and governance as core security outcomes, not optional admin tasks.

For NHI programmes, the warning signs usually show up before a breach. Rising exceptions, repeated approval overrides, and undocumented identities discovered during certification cycles all indicate that discovery is lagging behind infrastructure change. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs, which helps explain why sprawl often persists unnoticed. In practice, many security teams encounter identity overload only after access reviews start failing to remove the same hidden accounts over and over, rather than through intentional governance design.

How It Works in Practice

Organisations can tell identity sprawl is getting out of control by measuring whether the environment still behaves like a governable identity system. A healthy programme can inventory identities, map them to owners, classify their privilege, and remove them when they are no longer needed. An unhealthy one accumulates exceptions, duplicate credentials, and orphaned accounts faster than teams can certify them. That is why discovery, lifecycle management, and review outcomes matter more than raw identity counts.

Start by comparing three signals over time: inventory completeness, privilege concentration, and remediation speed. If new identities appear in CI/CD, cloud, SaaS, and agentic workflows faster than they are tagged and assigned, sprawl is growing. If a small set of accounts keeps holding elevated rights, especially outside change windows, that is a privilege control gap. If access reviews repeatedly surface the same undocumented identities, then the review process is validating drift rather than correcting it. NHIMG’s Top 10 NHI Issues research is useful here because it frames visibility, rotation, and offboarding as linked controls, not separate tasks.

• Track the ratio of discovered identities to identities with named owners.
• Measure how many privileges require manual exception handling each month.
• Check whether stale secrets and dormant accounts survive multiple review cycles.
• Watch for identities created outside standard provisioning paths, especially in automation pipelines.

Current guidance suggests treating the combination of hidden identities, long-lived secrets, and repeated manual approvals as a single risk pattern. The NIST CSF 2.0 supports that approach by tying inventory, protection, and recovery together, while the Ultimate Guide to NHIs — Key Challenges and Risks shows how overprivilege and poor secret handling compound one another. These controls tend to break down in fast-moving cloud and CI/CD environments because identities are created ad hoc, used briefly, and forgotten before governance processes can catch up.

Common Variations and Edge Cases

Tighter identity control often increases operational overhead, requiring organisations to balance faster delivery against more frequent review and remediation work. That tradeoff is real, especially where engineering teams rely on ephemeral workloads, third-party integrations, or automation that creates identities at machine speed. Best practice is evolving, and there is no universal standard for how much sprawl is acceptable in every environment.

Some environments look messy but are still manageable. For example, a large number of short-lived workload identities may be normal if they are cryptographically bound to workloads, carry short TTLs, and are automatically revoked. By contrast, a smaller number of dormant but highly privileged accounts can be more dangerous than a larger estate of tightly governed ephemeral identities. That is why raw volume alone is a poor signal.

The practical edge case is when exceptions become the operating model. If teams routinely bypass provisioning controls to ship work, or if offboarding requires manual chase across multiple systems, sprawl is no longer a side effect. It has become the identity architecture. At that point, the right question is not whether the estate is large, but whether any identity can still be explained, owned, and removed on demand.

Related resources from NHI Mgmt Group

• How do organisations know whether identity automation is actually improving control?
• How can organisations tell whether assistant governance is working?
• How can organisations modernise identity without losing control?
• When should organisations prioritise change control in identity projects?