What should CISOs prioritise if identity is meant to support business growth?

Why This Matters for Security Teams

If identity is meant to support business growth, CISOs have to treat it as an operating model, not just a control plane. Speed matters, but so does the ability to prove who or what is acting, what it can access, and whether that access is still appropriate. That is especially true for non-human identities, where scale, automation, and hidden privilege can turn a convenience layer into an attack path. NHI Management Group’s Ultimate Guide to NHIs notes that NHIs outnumber human identities by 25x to 50x in modern enterprises, which is why identity sprawl quickly becomes a business risk. NIST’s NIST Cybersecurity Framework 2.0 reinforces that governance and risk management must be embedded into operations, not bolted on after deployment. In practice, many security teams encounter entitlement drift and unmanaged service access only after growth has already expanded the blast radius.

How It Works in Practice

For CISOs, the practical priority is to fund identity capabilities that increase throughput without weakening assurance. That means reducing manual entitlement work, shortening approval cycles, and making access decisions more precise. The highest-value programmes typically combine lifecycle control, privilege minimisation, and continuous visibility so the business can onboard apps, partners, and automation faster without accumulating hidden access debt.

For NHIs, the controls that matter most are the ones that govern issuance, rotation, and revocation at machine speed. The Top 10 NHI Issues research shows how often organisations fail at basic hygiene such as rotation and offboarding, which undermines both resilience and auditability. Current guidance suggests prioritising:

• Lifecycle ownership for every identity, including service accounts, API keys, and workload credentials.
• Least privilege by default, with access scoped to a defined business purpose rather than broad roles.
• Automated provisioning and revocation so access changes keep pace with application and team changes.
• Visibility into where credentials live, how long they remain valid, and whether they are still in use.
• Policy enforcement that can be measured and audited, not just documented in standards language.

That approach aligns with the NIST framework’s emphasis on governance, protection, and continuous improvement, and it is also consistent with lessons from the 52 NHI Breaches Analysis, where unmanaged machine identities repeatedly amplified compromise. These controls tend to break down in fast-moving CI/CD and SaaS-heavy environments because credentials are created faster than they are inventoried.

Common Variations and Edge Cases

Tighter identity governance often increases process overhead, so organisations have to balance agility against control depth. That tradeoff is real, especially where product teams expect self-service access and partners need rapid integration. Best practice is evolving, but there is no universal standard for this yet across all identity domains, so CISOs should avoid assuming that one access model fits every workload.

One edge case is when identity supports external growth through vendors, APIs, or customer-facing automation. In those environments, the question is not only whether access is least privilege, but whether the identity can be continuously validated and retired when the business relationship changes. Another edge case is legacy infrastructure, where long-lived credentials and static roles may still exist because migration risk is high. In those settings, the priority should be reducing exposure first, then improving governance iteratively.

NHIMG’s breach research on the Cisco DevHub NHI breach shows how quickly identity weaknesses can turn into enterprise-wide exposure when access is broad and oversight is weak. The practical rule is simple: if identity cannot scale with the business while preserving auditability, it is not enabling growth, it is deferring risk.

Related resources from NHI Mgmt Group

• When should organisations use AI-driven decision support in identity governance?
• How should security teams prioritise NHI remediation in cloud environments?
• When does a machine identity become a compliance problem?
• Why is it important to integrate identity and data governance?