Why do legacy identity practices create more risk as organisations adopt AI and faster application change?

Why This Matters for Security Teams

Legacy identity practices are built for a slower operating model: named users, periodic access reviews, fixed roles, and manual approvals. That model breaks down when organisations ship code continuously, connect new SaaS and APIs weekly, and introduce AI systems that can act autonomously. Security teams then inherit a governance gap where identity decisions lag behind real system change, creating standing access that is hard to justify and even harder to retire.

This is not just an operational nuisance. NHI sprawl and secret leakage often become the path of least resistance when delivery teams need speed and the identity process cannot respond. NHIMG research on Ultimate Guide to NHIs and 52 NHI Breaches Analysis shows how quickly unmanaged machine access becomes a recurring attack path. The control issue is amplified when teams rely on static entitlements instead of the adaptive governance model described in the NIST Cybersecurity Framework 2.0.

In practice, many security teams encounter the compromise only after a service account, API key, or agent credential has already been reused across systems and quietly expanded the blast radius.

How It Works in Practice

The practical problem is not identity in the abstract, but the mismatch between static control models and dynamic workloads. Traditional RBAC assumes access can be predicted in advance. That is workable for a stable employee population, but it is weak for CI/CD pipelines, ephemeral cloud services, and AI agents that choose actions at runtime. Current guidance suggests moving toward workload identity, short-lived credentials, and policy evaluation at request time rather than relying on quarterly review cycles.

For machine and agent identities, the better pattern is to bind access to the workload, the task, and the context. That usually means issuing ephemeral secrets only when needed, revoking them automatically, and using cryptographic identity proofs such as OIDC tokens or SPIFFE-style workload identity. For AI systems, the control challenge is even sharper because the agent can chain tools, call external APIs, and request new privileges mid-task. NHI governance should therefore connect identity, policy, and telemetry so each action is evaluated against current intent, environment, and risk.

• Use NIST Cybersecurity Framework 2.0 to align identity governance with continuously changing assets and services.
• Use runtime authorization rather than static allowlists where agent behaviour is variable.
• Issue just-in-time access for tasks, not durable credentials for entire workflows.
• Monitor secret creation, reuse, and revocation as first-class security events.

NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks and JetBrains GitHub plugin token exposure both illustrate the same pattern: once secrets are embedded in workflows, revocation and traceability become reactive instead of preventive. These controls tend to break down when application teams can create new identities faster than security teams can inventory and govern them.

Common Variations and Edge Cases

Tighter identity control often increases delivery overhead, so organisations have to balance speed against assurance rather than pretending both come for free. The biggest tradeoff appears in high-churn environments such as platform engineering, microservices, and agentic AI pipelines, where too much manual approval will push teams toward shadow access and ad hoc credential sharing.

There is no universal standard for this yet, but best practice is evolving toward policy-as-code, continuous discovery, and workload-scoped authorisation. In regulated environments, that may mean stronger evidence collection and shorter credential lifetimes. In less mature environments, it may mean focusing first on the highest-risk identities: privileged service accounts, secrets with broad reuse, and AI agents with tool access. The challenge is especially acute when automation creates identities faster than governance can classify them, because access reviews then become a retrospective exercise rather than a real control.

NHIMG’s Top 10 NHI Issues helps frame the most common failure modes, while the 2024 ESG Report: Managing Non-Human Identities shows how often compromised machine identities are already part of incident history. The practical rule is simple: if the environment changes faster than identity governance can follow, legacy controls will lag behind the threat surface.

Related resources from NHI Mgmt Group

• Why does application sprawl create security and compliance risk even when organisations already have an identity programme?
• Why do poor password practices still create risk even when organisations use password managers?
• How should organisations govern identity risk when using AI assistants like Microsoft 365 Copilot with enterprise data?
• When does an AI assistant create more identity risk than a normal application?