Inside the Growing Problem of Identity Sprawl

Identity still works in most enterprises. Employees authenticate. Applications connect. Automated processes run without interruption. But security teams increasingly describe a more troubling condition: Certainty in identity management is disappearing.

See Also: On-Demand | NYDFS MFA Compliance: Real-World Solutions for Financial Institutions

Traditional models for governing identity, built around predictable human life cycles and review cycles, are buckling under the weight of modern enterprise complexity. Practitioners and researchers blame it on identity sprawl: a systemic drift in how identities are created, used and governed across digital environments.

Across cloud platforms, development pipelines and automation frameworks, identities are created, used and discarded at a pace governance models were never designed to handle. Many of these identities are not human. They belong to services, APIs, workloads and increasingly autonomous systems that appear and disappear in seconds.

It’s not an academic concern. Investigations and threat analyses show that organizations are not just struggling to see all their identities – attackers are weaponizing exposed identity data on an industrial scale. 72% percent of identity leaders report that the threat level of identity-related attacks increased or stayed the same in the past year.

When Identity Life Cycles Stopped Being Predictable

For years, identity governance relied on a set of assumptions tied closely to human behavior. Employees joined organizations, moved roles and eventually left. Even when access reviews lagged or controls were imperfect, identities persisted long enough to be corrected. That model no longer reflects reality.

The difference between human and machine identities isn’t just scale. “With human identities, if people are coming into your organizations as employees, you onboard them. They work, and by the time they leave, you can deprovision them,” said Haider Iqbal, director of product marketing for identity and access management at Thales.

Machine identities don’t follow that pattern. “With machine identities, they come and go in seconds,” Iqbal said. “So that gives you a magnitude of not just the size, but the velocity of the problem as well.”

That velocity breaks traditional joiner-mover-leaver models. By the time a review occurs, the identity may already be gone, or its credentials may have been reused elsewhere.

Visibility Breaks Before Control Does

Once identity life cycles lose their predictability, visibility becomes the next constraint.

Identity environments have expanded across multiple platforms, each with its own controls and data. Authentication platforms, identity governance tools, privileged access systems, cloud IAM services and application-level controls now each manage part of the picture.

This fragmentation has made it increasingly difficult for organizations to understand their effective identity posture.

“Organizations are using AI today, whether they know it or not,” said Morey Haber, chief security advisor at BeyondTrust. “And most organizations don’t even know that it’s deployed in their environment.”

That lack of awareness is not limited to AI. Many security teams struggle to maintain a reliable inventory of non-human identities, especially when those identities are created dynamically by automation or cloud services. Visibility gaps don’t stop access from being granted, but they do prevent teams from confidently enforcing policy.

“Without integration … I don’t know what it’s doing, and then I got to go figure it out. When you unify together, then you have all the AI visibility,” Haber said, describing the operational impact of fragmented tooling.

Under those conditions, governance often becomes increasingly ad hoc. Controls may exist, but they can lag behind identity creation rather than shaping it.

CyberArk research also shows that these visibility gaps are often reinforced by identity silos, with access and privilege spread across disconnected tools and platforms rather than managed as a single system of record.

That gap between visibility and control is increasingly reflected in breach data. SpyCloud’s 2025 Annual Identity Exposure Report shows identity information circulating at industrial scale, with billions of records tied to breached accounts, malware infections and exposed credentials. When researchers correlate those datasets, a single corporate identity is often linked to dozens – or even hundreds – of exposed data elements.

Attackers no longer rely on a single username and password. They assemble identity fragments – credentials, session cookies, personal attributes and device data – to impersonate users and move laterally without triggering multifactor authentication or other security checks. In that context, identity sprawl is not only an internal governance challenge, but an expanding external attack surface.

Privilege Becomes the Default, Not the Exception

Visibility gaps matter most when they intersect with privileged access. Modern enterprise environments rely on elevated access for cloud orchestration, application integration and automated workflows. Service accounts and application programming interfaces often require broad permissions to function reliably.

Those permissions often persist when environments change. Access granted to support a specific task is rarely revisited, especially when the identity is non-human. Periodic access reviews typically focus on workforce users, while access held by machine identities is less consistently examined.

Industry research suggests this imbalance is now structural. According to CyberArk’s 2025 Identity Security Landscape report, machine identities vastly outnumber human identities in most enterprise environments, yet governance models continue to define privileged users primarily as people. In large organizations, machine identities already outnumber human identities by orders of magnitude, even as access review and privilege frameworks remain centered on workforce users. Service accounts, workloads and automation systems routinely hold persistent, high-impact access without being subject to the same review cycles or life cycle controls.

Attackers exploit this dynamic environment by looking for paths between identities rather than individual accounts.

That shift has forced many organizations to reassess how they think about privileged access models. “Traditional PAM was really designed to mitigate the risk of an insider threat in an IT environment,” said Darren Guccione, co-founder and CEO of Keeper Security. “But with multi-cloud computing, hybrid and distributed remote work, you need PAM extended, enterprise-wide.”

In environments where privilege is widespread and poorly understood, identity sprawl can become an access amplification problem rather than a simple inventory issue. The challenge is not only how much privileged access exists, but how that access is defined, classified and reviewed across different types of identities.

Why Replacement Strategies Don’t Solve the Problem

The growing complexity of identity environments – spread across cloud platforms, legacy systems, automation frameworks and multiple control layers – has pushed many organizations toward identity modernization. These initiatives are often framed as necessary resets.

“One of the biggest challenges with migration is its very risky,” said Anshita Mittal, vice president of delivery and senior technical architect at IDMExpress. “There have been lot of studies that have shown that, because of these risks, 70% of the migrations fail.”

Large migrations introduce disruption and transitional gaps, but more importantly, they treat identity sprawl as a technology problem rather than a life cycle problem. Identity creation doesn’t slow down during a migration. Machine identities continue to appear, often outside the scope of the project.

Some organizations are responding by changing how they approach identity control. Instead of wholesale replacement, they’re shifting toward incremental life cycle management. Rather than trying to govern every identity at once, they focus on reducing the time unmanaged access can persist.

Mittal describes this approach as evolution rather than disruption. “I do not have to do the complete replacement of the new product,” she said. “I can take my existing product and evolve it one step at a time.”

This reflects a recognition that identity sprawl is ongoing, and governance must adapt continuously rather than assume a stable end state.

Trust Moves From Policy to Operations

As AI and automation are now moving into production environments, identity systems are being asked to support actions, not just authentication. Organizations want systems that can operate without constant human oversight, while still remaining within defined boundaries. That shift exposes the limits of manual governance.

“The real concern I hear is, how do I govern them to make sure that these agents actually stay within the guardrails and the balance that I’ve set up for them? And then, what do I do when something goes wrong?” said Dev Rishi, general manager of AI at Rubrik.

Many organizations, Rishi said, remain cautious. “AI has been transformational for a lot of organizations, but still in this heavy read-only mode.”

Trust, in this context, is defined less by policy and more by day-to-day operations. It depends on visibility into identity activity, enforceable controls and the ability to address unexpected behavior quickly.

Experts say identity sprawl isn’t a temporary side effect of digital transformation. It’s a structural outcome of how enterprises build systems that rely on automation, cloud services and AI. The challenge for security and risk leaders is whether identity life cycle management can evolve fast enough to keep governance aligned with reality.