Identity security has traditionally been viewed as an IT or access management function. Why do you believe it has become a business-wide security priority?
Identity failures no longer stay inside IT. Access management once meant a directory and a provisioning queue. Today, the systems holding revenue data, patient records, and manufacturing controls are reached through federated paths that cross cloud providers, SaaS tenants, and third-party integrations. Identity enforces access to all of it.
The Verizon 2026 Data Breach Investigations Report found the human element present in 62% of breaches, with credential abuse appearing in the attack chain 39% of the time, the most pervasive single action in the dataset. An attacker who authenticates doesn’t need an exploit.
Regulation has moved in the same direction. Operational resilience rules, defense supply chain requirements, financial reporting controls, and insurance underwriting all depend on access evidence, and that scrutiny now reaches the audit committee.
Identity gaps also slow the business down. Acquisitions can stall on entitlement reconciliation. Customer security reviews can stop when clear certification evidence can’t be produced.
What are organizations missing when they focus on identity tools but not identity governance?
Governance gives you four things a license does not: a clear, accountable owner for each identity type, a defined lifecycle from creation to decommission, a control set mapped to whatever frameworks your organization is audited against, and a baseline that shows where you stand and how that’s changing.
Without governance, partial coverage can look complete. Workforce accounts may sit in the governance platform, privileged accounts in the vault, service accounts sit nowhere at all, and application-local accounts created outside federation can remain invisible to both systems. Certification then ends up attesting to a fraction of the environment, while auditors and attackers work from the whole thing.
Tools can also force decisions that governance should settle first: which system is authoritative for identity, which attribute drives entitlement assignment, and what happens when a source record changes instead of disappearing.
At Evolving Solutions, our Identity Security assessment scores 16 identity domains against roughly 2,400 mapped controls, which establishes where things stand before a platform decision follows.
Non-human identities now outnumber human users in many environments. What risks does that create, and why should organizations be paying closer attention?
Non-human identities rarely expire. Entitlements get granted at creation, sized for convenience, and then never revisited. There’s no joiner-mover-leaver process for a service account, so when an application gets decommissioned, its credentials often stay live and forgotten.
The Verizon 2026 Data Breach Investigations Report ties third parties to 48% of breaches, up 60% year over year, and links many of the underlying cloud incidents to missing multifactor authentication (MFA), improper credential rotation, and missing least-privilege enforcement across both human and service accounts. Only 23% of third-party organizations fully fixed missing or improperly secured cloud MFA.
Vaulting is frequently mistaken for governance. A secrets manager stores and rotates a credential, but it doesn’t tell you who owns it, what it’s scoped to do, or who’s accountable for it. Non-human identities require the same governance system of record as human identities.
As AI adoption accelerates, how does identity security need to evolve to support and govern AI agents?
An AI agent is an identity acting with delegated authority, at machine speed, inside systems built to authorize a human logging in. Before any agent goes into production, organizations need three things to be in place and true.
First, attribution: the authorization record has to show which agent acted, on whose behalf, and under what grant. SPIFFE issues the workload’s cryptographic identity. IETF WIMSE is standardizing a shared cross-system workload identifier, though it’s still a draft, not a finished spec. OAuth 2.0 carries that delegated authority through the call chain.
Second, scope: the agent gets only the authority its task actually needs, sized to that task, with an expiration on the grant.
Third, revocation: this is where most environments fall short today. Session-length authorization doesn’t cut it. The OpenID Foundation finalized the Shared Signals Framework 1.0 and Continuous Access Evaluation Profile 1.0 in September 2025 specifically to close that gap.
Bottom line: AI agents belong in the governance system of record, with a real human owner, clear accountability and the same certification cadence as everyone else.
