The Data Governance Crisis No One Has Fully Solved

There was a time when securing identity meant securing people: a user, a password, a role. Multi-factor authentication added a layer. Privileged access management added another. The problem was complex but at least it was bounded. You could in principle enumerate every identity in your environment and govern it.

That time is over.

The identity estate of a modern enterprise has expanded so far beyond human users that legacy IAM thinking isn’t just incomplete, it’s structurally mismatched with the actual threat surface. The traditional model was built around people. What most organisations are running today is something different entirely: a vast, largely ungoverned, infrastructure of machine credentials, service accounts, API tokens, AI agents, and SaaS-to-SaaS connections that outnumber human users, operate with minimal oversight, and represent the primary pathway attackers are now actively exploiting.

The Identity Estate Has Exploded — and Most of It Isn’t Human

The scale of this shift is difficult to overstate. Non-human identities now outnumber human identities by 144 to 1 in the average enterprise, a ratio that jumped from 92:1 in 2024, itself a staggering figure. Between 2024 and 2025 alone, the volume of non-human identities in enterprise environments grew by 44%. Every cloud workload, every microservice, every AI agent, every automated pipeline requires credentials. Most of those credentials are created quickly, granted broad permissions, and rarely reviewed again.

The governance gap this creates is immediate and measurable. 97% of non-human identities carry excessive privileges and 92% are exposed to third parties whose security practices are entirely outside the organisation’s control. These aren’t edge cases. This is the baseline state of identity governance in most enterprises right now.

The secret management problem is equally severe. 23.77 million secrets were leaked on GitHub in 2024 alone — a 25% year-over-year surge. API keys, service account credentials, access tokens, committed to repositories, shared in collaboration tools, synced to personal devices via cloud storage, persisting in CI/CD logs long after the humans who created them have moved on. Nearly half of all non-human identities in the average enterprise are more than a year old, and some persist for a decade or more, retaining access to systems whose original owners no longer exist.

Traditional IAM tools weren’t designed for any of this. They were built to manage human users. Applying them to a machine identity estate of this scale and complexity is the security equivalent of using a street map to navigate a city that has tripled in size since the map was printed.

SaaS Sprawl Has Made Data Governance a Fiction

If the non-human identity problem is about what’s connecting to your systems, the SaaS sprawl problem is about where your data actually lives — and the answer, for most organisations, is: everywhere, but nowhere you can fully govern.

The average enterprise employee now uses 13 SaaS applications, up from 7 just three years ago an 85% increase driven by the ease of procurement, the proliferation of point solutions, and the steady normalisation of business units adopting tools without formal IT involvement. The result is an application estate that has outrun its own governance. IT is typically aware of only a third of the applications in active use across the organisation. The other two-thirds, the shadow SaaS, the departmental subscriptions, the AI tools employees started using because they were free and fast, are invisible to the security team.

Data in this environment doesn’t stay put. It flows through SaaS environments, gets processed by third-party integrations, enters AI tools that may retain it for model training, and moves through OAuth connections that link applications to each other with permissions that nobody explicitly reviewed. The concept of a governed data store, a defined location with classification policies, access controls, and a clear owner has, for most organisations, been replaced by a distributed, dynamic, and largely unmapped data flow.

The compliance and security implications are not theoretical. 65% of CISOs cite tracking and monitoring security risks from third-party connected applications as a top challenge. 63% flag data governance and privacy as an ongoing difficulty. These are not niche concerns from organisations at the early stages of digital maturity. They are the dominant challenges for security leaders at organisations that have been running cloud and SaaS environments for years.

Zero Trust Is Right — But the Scope Is Wrong

Zero Trust architecture has become the consensus response to identity complexity, and for good reason. The principle, verify every access request explicitly, assume no implicit trust based on network location or previous authentication is exactly the right instinct for an environment where the perimeter has dissolved.

The problem is that most Zero Trust implementations have been scoped almost entirely around human users. Humans get MFA, conditional access policies, behavioural analytics, and privileged access workflows. Machine identities, the 144 non-human actors for every human in the environment typically get none of it.

OAuth tokens, the primary mechanism through which SaaS applications connect to each other, have no equivalent of multi-factor authentication. When a SaaS application is granted permission to access another, that connection is effectively a permanent, single-factor trust relationship between two systems. It doesn’t expire automatically. It doesn’t require periodic re-authorisation. And because it operates at the application layer rather than the user layer, it sits outside most identity monitoring programmes entirely.

This is not a minor gap. It is the mechanism by which an enormous proportion of modern enterprise data flows, and it operates on the assumption of trust that Zero Trust was designed to eliminate, while applied to the most active and least visible category of identity in the environment.

Until Zero Trust is extended to machine identities with the same rigour applied to human users, least privilege enforcement, lifecycle management, continuous monitoring, anomaly detection, the model is solving a partial version of the problem and leaving the majority of the attack surface ungoverned.

Identity Is the Attack Vector — and Attackers Already Know It

None of this would matter if adversaries hadn’t already figured out that identity is the path of least resistance into a modern enterprise. But they have.

Credential-related breaches take an average of 328 days to identify and contain — this is the longest dwell time of any breach category, and more than three times the detection time for breaches discovered proactively. The reason is straightforward: a stolen credential doesn’t look like an attack. It looks like normal access. Without behavioural baselines and anomaly detection layered on top of authentication data, the difference between legitimate users and an attacker using their credentials is invisible.

Identity fraud losses reached $27.2 billion globally in 2024, a 19% increase year-over-year. The attack patterns driving that number aren’t sophisticated zero-days. They are credential abuse, account takeover, OAuth token theft, and the systematic exploitation of over-privileged service accounts that haven’t been reviewed in months or years.

The fourth-party risk dimension adds a further layer of exposure that most organisations have barely begun to address. When a SaaS provider integrates with another service to deliver functionality, data may flow to that fourth party without the organisation’s knowledge or explicit consent. The organisation’s security team has no visibility into the security practices of those downstream actors, no ability to enforce access controls on them; and, in many cases, no knowledge they exist. Every OAuth connection is a potential chain into a vendor’s vendor whose security posture is entirely unknown.

What Effective Identity Governance Actually Looks Like in 2026

Closing this gap isn’t a single-product problem. It requires a shift in how identity is treated across the security programme.

Full NHI discovery before anything else. You cannot govern what you cannot see. The starting point is a complete inventory of non-human identities across cloud environments, SaaS platforms, and internal systems — including service accounts that haven’t been touched in years, tokens that outlived the applications that created them, and AI agent credentials that were provisioned outside of the formal IT process. Discovery is not a one-time exercise; it needs to be continuous, because the NHI estate changes faster than any static audit can capture.

Least privilege applied to machines, not just humans. The fact that 97% of NHIs carry excessive privileges is not a statistic about carelessness — it’s a structural outcome of an IAM model that was never designed for machine identities. Applying least privilege to service accounts, API tokens, and AI agents requires both tooling that can assess and enforce permissions at scale, as well as a governance process that treats machine identity management as a first-class security function rather than an IT administration task.

SaaS-to-SaaS connections as a governed attack surface. Every application integration, every OAuth permission grant, and every third-party connector should be treated as an identity relationship that requires the same scrutiny as a user access request — visible, time-limited where possible, regularly reviewed, and revoked when no longer needed.

Identity monitoring integrated into threat detection. Anomalous access patterns, a service account accessing systems it has never touched before, a token being used from an unexpected location, a credential being used outside its normal operational window — are among the highest-fidelity signals available to a security team. They should be feeding directly into threat detection and response workflows, not sitting in an IAM tool that no one is watching.

The Governance Challenge That Requires Human Expertise, Not Just Tooling

The honest assessment of where most organisations stand is this: the identity estate has grown faster than the governance capability to manage it, the tooling landscape is fragmented, and the internal teams responsible for identity security are stretched across too many other priorities to give governance the sustained attention it requires.

This is precisely why the identity-first, human-led model matters. Tools alone don’t solve identity complexity. Why? Because the problem isn’t primarily a detection glitch. It’s a judgment problem. Which of these 10,000 non-human identities represents genuine risk? Which SaaS connection warrants immediate revocation? Which anomalous access pattern is operational noise, and which is the early indicator of a credential compromise? Those are questions that require experienced practitioners making contextual decisions, not automated rules firing on static criteria.

SolCyber starts with identity and ends with transparency, protecting where attacks begin and keeping organisations informed with the visibility they need to make confident decisions. As a fully managed, human-led MSSP, SolCyber brings expert-driven protection across endpoint, identity, email, and cloud, removing the operational complexity that makes identity governance so difficult for internal teams to sustain at scale.

For organisations where the identity estate has outgrown what in-house capability can effectively manage — which, according to recent data, describes most enterprises — a human-led managed security partnership isn’t a workaround. It’s the right architectural response to a problem that tooling alone has repeatedly failed to solve.

The perimeter is now identity. The question is whether you can see all of it.

Want to understand what identity-first managed security looks like in practice? Explore SolCyber’s approach to human-led protection.

Photo by Carson Arias on Unsplash