DEV Community: bridgesoft

Your IAM Passed the Audit. But Is Your Identity Security Actually Working?

bridgesoft — Mon, 12 Oct 2026 10:36:26 +0000

Verizon's 2026 Data Breach Investigations Report contains a number that looks like good news: credential abuse as the first step in a breach fell to 13%, while vulnerability exploitation rose to 31% (TechRepublic summary of the 2026 DBIR). But that does not mean identity risk is going away. The same report shows credential abuse appears at some point in 39% of breaches (Passwork analysis of the DBIR). In other words, attackers may enter through software vulnerabilities, but they still rely on identities, accounts, and permissions to move through systems.

That distinction matters for any executive who owns an IAM implementation. An access review that passes audit tells you the process ran. It doesn't tell you whether a contractor's account is still live, whether a service account holds admin rights, or whether an AI tool has quietly been given access to customer data.

This article explains what separates Compliance Centric IAM from strategic identity security, where programs stall, and how to sequence the work.

What does strategic IAM implementation mean?

Identity and access management (IAM) is the set of policies, processes, and technologies that make sure the right identities, human and non-human, have the right access to the right resources for the right reasons. Identity governance and administration (IGA) is the layer that adds oversight: lifecycle management, access certifications, separation-of-duties checks, and policy enforcement.

Compliance-centric IAM optimizes for evidence. Strategic IAM optimizes for risk reduction, and evidence follows.

Why compliance alone leaves a gap

Breaches are expensive and slow to contain. IBM's 2026 Cost of a Data Breach Report puts the global average at $4.99 million, and the U.S. average at $11.5 million. Mean time to identify and contain rose to 247 days (Baker Donelson summary). Breaches lasting more than 200 days cost an average of $5.65 million, versus $4.32 million for those contained sooner. Standing access that nobody revisits is exactly what stretches that timeline.

The Identity Defined Security Alliance (IDSA) found in its 2025 research that only 14% of organizations had no identity-related incident in the prior year (Biometric Update via CB Insights; report index at idsalliance.org). Treat that as a survey of identity and security professionals, not a census, but the direction is clear.

Identity governance challenges that stall programs

These are practitioner observations of how IGA programs typically struggle, not survey findings:

Certification fatigue. Managers approve hundreds of entitlements they can't evaluate. The review happens, but the control doesn't work.
Role sprawl. Roles built once and never pruned drift away from actual job functions.
Joiner-mover-leaver gaps. Transfers are the hardest case, because people accumulate access from old roles.
Unowned identities. Service accounts and API keys often have no named owner.
Disconnected data. HR, IT, and application owners each hold part of the picture.

AI for identity: the next frontier in identity governance

AI touches identity governance from two directions.

AI as something to govern. IBM's 2025 report found that 97% of organizations that reported an AI-related breach lacked proper AI access controls. Of breached organizations, 63% had no AI governance policy or were still developing one, and shadow AI added an average of $670,000 to breach costs (IBM announcement via HPCwire). In practice, an AI assistant connected to your CRM and file stores is an identity with permissions. It needs an owner, scoped access, and a review cycle.

AI as a governance tool. Machine learning can recommend access, flag outliers during reviews, and cut the manual workload. IBM's 2026 data shows organizations using AI and automation across security operations saved $1.93 million per breach and contained incidents 65 days faster (Fortra summary). That figure covers security operations broadly, not IAM specifically, and it compares extensive adopters with non-adopters, so don't read it as a forecast for your program.

A practical IAM implementation sequence

Inventory identities first. Count humans, contractors, service accounts, AI agents, and Integrations. Most organizations undercount the non-human ones.
Fix the lifecycle. Automate onboarding, transfer, and offboarding from the HR system of record before layering on anything advanced.
Tighten privileged access. Start with admin accounts and finance, HR, and customer-data systems.
Make reviews risk-based. Spend reviewer attention where the exposure is.
Bring AI and machine identities into scope. Assign owners and expiry dates.
Measure outcomes. Track time to revoke access, orphaned account counts, and privileged accounts without recent use.

When this works: a defined executive sponsor, clean HR data, and a willingness to retire legacy roles. When it doesn't: buying a platform to avoid an ownership conversation or launching every phase at once.

Common mistakes

Treating the audit result as the success metric.
Excluding contractors and vendors, even though third-party involvement in breaches is rising, per Verizon.
Automating a broken process, which just makes bad access faster.
Ignoring the business case. For CFOs, the useful framing is reduced exposure time and lower audit effort, not tool counts.

Conclusion
For organizations that already have IAM tools but lack clear ownership, clean lifecycle processes, or risk-based governance, Bridgesoft helps assess current IAM maturity and build a practical roadmap from compliance-driven access reviews to strategic identity security.

Compliance is a floor. Strategic identity security asks whether access is justified today, who owns it, and how quickly it can be removed. Start with an identity inventory and a lifecycle fix, then expand into privileged access and AI governance. If you'd like an outside view of where your program sits, Bridgesoft's identity consultants can run an IAM and IGA maturity assessment.

Frequently Asked Questions

What is IAM implementation?
It's the process of deploying and configuring the policies, processes, and tools that control who can access which systems and data. It typically includes authentication, single sign-on, provisioning, access governance, and privileged access management.

What's the difference between IAM and identity governance?
IAM manages how identities authenticate and get access. Identity governance adds oversight: who should have access, who approved it, and whether it still fits their role.

Why isn't compliance enough for identity security?
Audits test whether a process ran, not whether access is appropriate. Credential abuse appears in 39% of breaches at some stage (Verizon 2026 DBIR via Passwork).

How should organizations govern AI agents?
Treat each as an identity with a named owner, least-privilege access, logging, and periodic review. IBM's 2025 data links missing AI access controls to breaches.

How long does an IAM implementation take?
It varies with scale, application count, and data quality. Phased rollouts, starting with lifecycle automation and privileged access, usually show value sooner than all-at-once deployments.

AI Agents Need Identities Too: Governing Non-Human Access in 2026

bridgesoft — Wed, 30 Sep 2026 18:00:08 +0000

Consider a finance team that deploys an AI agent to reconcile invoices. To get it running quickly, someone attaches it to an existing service account with broad ERP access and stores the credentials in a configuration file. Six months later, the project owner has changed roles, the agent also touches procurement data, and no one can say who approved that. This is a hypothetical scenario, but the pattern is common. Nothing malicious happened. Access drifted because nobody governed it.

That gap is what identity governance for AI agents is meant to close. This article explains what it involves, why service accounts don't solve it, and how to build controls that hold up under audit.

What is identity governance for AI agents?
Identity governance is the practice of deciding who or what can access which systems, keeping that access appropriate over time, and proving it to auditors. For AI agents, it means treating each agent as an identifiable entity with an accountable owner, defined permissions, and a lifecycle. It does not mean letting an agent run anonymously under a shared credential.

The term "non-human identity" (NHI) covers any digital identity not tied to a person: service accounts, API keys, bots, workload identities, and now autonomous agents. Governing them falls under Identity Governance and Administration (IGA), the discipline that already handles joiner-mover-leaver processes and employee access reviews.

Why aren't service accounts enough?
Service accounts assume predictable behavior. A nightly backup job does the same thing every night, so a static permission set fits. An AI agent chooses which tools to call, and its behavior can change with prompts, data, and connected integrations.

The last row matters most. Employees leave through HR processes. Agents and service accounts typically have no equivalent trigger, so they accumulate.

What are standards bodies saying?
Two developments are worth knowing about, each with a caveat.

In February 2026, NIST's National Cybersecurity Center of Excellence published a concept paper on this topic. It explores standards-based approaches to identifying, managing, and authorizing the access and actions of software agents, including AI agents. Public comment ran through April 2, 2026. This is a proposal for a potential project rather than final guidance or a compliance requirement, but it shows where U.S. expectations are heading.

On the threat-modeling side, the OWASP Top 10 for Agentic Applications 2026, published December 10, 2025, uses "Least Agency" as a framing principle, the agentic counterpart to least privilege. It’s practical vocabulary for security teams to adopt now.

A practical framework: govern the agent like a workforce member

Inventory first. Find the agents, bots, and service accounts already running, including those business teams set up without IT involvement.
Name an accountable owner. Every agent needs a human who answers for its access. If the owner leaves, ownership must transfer, or the agent must be suspended.
Scope to the task, not the team. Give the invoice agent read access to invoice records, not the entire ERP. Limit both what data it can reach and which actions it can take (read, draft, approve, pay).
Use short-lived credentials. Avoid static keys embedded in code. Expiring tokens limit the damage if one leaks.
Log and review. Record what the agent did, not just that it authenticated. Include agents in periodic access certification, with the owner attesting that the access is still needed.
Define retirement. Set an end date or review date at creation, and deprovision when the project, owner, or underlying model changes.

When this works well: organizations that already run a functioning IGA program can extend it, since owners, reviews, and lifecycle events are familiar concepts. When it doesn't: if your human identity data is unreliable, adding agents will amplify the problem. Fix the foundation first.

Where Bridgesoft fits:
Bridgesoft is an identity and access management (IAM) and identity governance consultancy and a SailPoint partner. For non-human accounts such as service accounts, Bridgesoft's non-human accounts solution covers lifecycle management from creation to retirement, along with activity monitoring, audit, and reporting. Its Identity Gateway, built on the SCIM protocol, brings applications that standard connectors can't reach into the governance program. Governing AI agent identities is an area Bridgesoft is focused on as this space matures.

Conclusion:
AI agents are a new kind of workforce member. They act on their own, hold real access, and rarely leave through an exit interview. The fix is not exotic: known owners, narrow scope, expiring credentials, regular review, and a defined end of life. Make a list of everything that already exists. If you'd like a second opinion on how your current identity governance program handles non-human access, Bridgesoft's team can walk through it with you.