Introducing Identity Lifecycle Management

A line from a conversation last week has stayed with me:

"Humans start attacks. Machines sustain them. Agents accelerate them."

That one sentence captures the shift happening across identity today.

Most organizations still treat compromise as a human problem. Phishing, MFA fatigue, and social engineering remain the entry points. But once inside, attackers look for identities the environment treats as always on, long-lived service accounts, automation identities, integrations, and machine-to-machine connections that rarely get reviewed.

Series 1 introduced the capabilities of modern identity. Series 2 moves into the operating model, how those capabilities are implemented and sustained so every identity type moves through the environment with the same discipline.

Lifecycle is where that structure becomes real.

We are now seeing identities that can create, modify, or delegate other identities on their own. LLMs and orchestration frameworks can generate identities faster than any manual control can respond. For the first time, an identity can create another identity without a human in the loop. That changes the operating landscape in a meaningful way.

Yet the industry still tries to solve these challenges in silos. PAM in one place. IGA in another. CIAM somewhere else. Modern risks don't respect those boundaries. The operating model has to unify the signals across all identity types so the environment stays predictable and healthy.

Clear ownership

Defined purpose

Preapproved access with SoD built in

Continuous authorization

Disciplined decommissioning

Lifecycle is not a workflow. It is the structure that keeps these signals aligned across humans, machines, B2B connections, and customers, the backbone of a modern identity environment.

Over the next few posts, we'll explore how lifecycle governance works across the domains that matter most: workforce identity, nonhuman and machine identity, external and third-party identity, and customer identity as its own domain.

The attack surface is changing. Our operating model can change with it.

❓Are you seeing attackers shift from human accounts to machine persistence in your environment?

For more than two decades, I have led identity programs through reorganizations, mergers, audits, cloud migrations, authentication modernization, and the quiet work of cleaning up what no one else wanted to touch. Across every one of those environments, the same patterns kept showing up. Unclear ownership. Broken lifecycle. Tools chosen before the problem was understood. Teams carrying responsibility they were never given the structure to hold.

I know what it is to build the plane while flying it. To fix foundations, stand up governance, and keep operations running at the same time, often with no budget to do any of it. To be told identity is critical and then handed a queue, a backlog, and an audit finding instead of a strategy.

This book is for the leaders living inside that reality.

It is not a tool guide. It is an operating model. A way to make identity predictable, trustworthy, and sustainable across governance, lifecycle, access, technology, and people. It is the framework I wish I had been handed early in my career.

If you have been reading the series here on LinkedIn, that is where the thinking lives while the book takes shape. More to share as it gets closer.