TL;DR: Identity security is often treated as a technology problem, but many organizations’ greatest risk is unclear accountability. As non-human identities such as service accounts, APIs, workloads, and AI agents multiply, organizations need more than tools. They need clear ownership, defined decision-making authority, and accountability for identity risk, incident response, and recovery. When identity systems are compromised, technology can provide visibility, but accountability is what drives action. In the end, the most resilient organizations are those who know who is responsible when decisions matter most.
Spend enough time in cybersecurity and you start to see the same problems come up. We talk a lot about identity technology, including privileged accounts, non-human identities, misconfigurations, hybrid complexity, attack paths, and the latest techniques attackers are using to compromise credentials.
These are important topics and deserve attention. But after years of working with enterprise organizations, I’ve come to believe that a lot of identity failures aren’t really technology failures. They’re failures of identity accountability.
When I talk to customers about identity risk, I usually ask some version of these simple questions:
- Who owns the identity layer?
- Who is responsible for identity risk?
- Who has the authority to make a decision during an incident?
- Who is accepting responsibility for the outcome?
The answers are often less clear than you’d expect. And that’s a problem.
Identity has lived in a gray area for too long
Identity is critical infrastructure, but in most organizations, no one person or team owns all of it. Infrastructure manages Active Directory. Security teams monitor threats. IAM handles provisioning and governance. Cloud teams administer Entra ID and SaaS environments. Application owners manage access to critical business systems.
Everyone touches identity, but nobody fully owns it.
Over time, identity has become a shared responsibility, spread across multiple teams, technologies, and processes. That can work fine until something goes wrong. Then the gaps between teams suddenly matter.
Attackers don’t care how your organizational chart is structured. They are looking for the fastest path to privileged access and control. When they find one, uncertainty about identity accountability can slow down the response at exactly the wrong time.
Technology isn’t the limiting factor
Most organizations have plenty of identity technologies. They’ve invested in governance, monitoring, privileged access controls, and identity and access management. Yet major identity-related incidents continue to occur.
The reason? Tools can tell you when something is wrong, however they can’t decide what the business is willing to do about it. Someone needs to decide whether to disable an account, revoke access, isolate a system, of begin recovery, often with real business consequences.
That takes authority and identity accountability, not another dashboard. I’ve watched technically mature organizations hesitate during incidents because everyone understood the risk, but no one knew who had the authority to act. The worst time to figure that out is during an incident.
The non-human identity explosion is making it worse
This challenge grows as organizations embrace automation, cloud services, and AI. Non-human identities now outnumber human users by a substantial margin. Service accounts, service principals, APIs, workloads, bots, and AI agents all need access to something.
Every new identity adds another question: who is accountable for them?
Inventory and permissions are necessary but identity accountability has to go further. Someone should own each identity through its lifecycle, ensuring its needed, its access makes sense, its monitored, and its removed when the job is done.
An unmanaged service account is a technical problem. One with no accountable owner is a governance problem.
Recovery reveals accountability gaps faster than anything else
We spend a lot of time talking about detection. But security leaders also need to be ready for the harder question: What happens if the identity layer itself is compromised?
If Active Directory is impacted, who has the authority to initiate recovery, determine whether systems are trustworthy, validate recovery objectives, and accept the business risk of restarting operations?
This is where gaps in identity accountability become obvious. Recovery requires clear decision-making authority, defined roles, and people who understand what actions to take under pressure. The worst time to discover those gaps is during a crisis.
What real accountability looks like
Fixing this doesn’t mean creating another team or assigning identity to a single department. Modern identity environments are too interconnected. Infrastructure, security, IAM, cloud, and application teams all have a role.
What’s important is getting specific about identity accountability. Organizations should define who is responsible for evaluating identity risk, who can make containment decisions during an incident, and who has the authority to initiate recovery when critical identity systems are compromised. Those responsibilities can’t be left to interpretation during a crisis.
Resilient organizations also make identity accountability visible. They know who owns critical identity platforms and non-human identities, who validates recovery plans, and they test those responsibilities prior to a crisis. Most importantly, they treat identity as a business risk, not just a technical function. Identity connects users, applications, workloads, and AI agents to enterprise systems, so decisions about identity risk have business consequences.
Organizations need clarity, not a perfect governance model. When an identity incident occurs, knowing there is a problem is part of the job. Someone has to have the authority and confidence to do something about it.
Accountability is the real control
Identity security conversations often begin with privileges, configurations, attack paths, and non-human identities. However, I recommend starting with a simpler question. Who is accountable?
The organizations that focus exclusively on technology risk are missing the deeper issue. The most resilient organizations aren’t necessarily the ones with the most tools. They are the ones that have clearly defined who is responsible for making decisions before a crisis occurs.
Because when identity becomes a target, identity accountability becomes the control. Someone has to control the outcome. If you can’t say who that is, you’ve found a gap that no security tool is going to fix.
