GIHAN MUNASINGHE
THE IDENTITY-FIRST ENTERPRISE: GOVERNING THE 50:1 MACHINE RATIO, ZERO STANDING PRIVILEGES, AND ARCHITECTING RESILIENT LEGACY MODERNIZATION
Published Exclusively by The Visionary CIOs (thevisionarycios.com)
Bureau of Enterprise Technology & Cybersecurity Architecture
EXECUTIVE EDITORIAL FOREWORD: IDENTITY AS THE ULTIMATE ENTERPRISE CONTROL PLANE
For decades, the architecture of enterprise computing was tethered to physical geography. Organizations constructed castles surrounded by digital moats: trusted employees sat inside corporate headquarters connected to physical Ethernet ports, while untrusted external traffic was filtered through perimeter firewalls and VPN concentrators. Security was defined by spatial location.
In today’s decentralized, multi-cloud enterprise ecosystem, that spatial reality has permanently evaporated.
The modern enterprise operates on a distributed fabric: remote workforces spanning global continents, hundreds of third-party SaaS applications, hybrid on-premises legacy mainframes, microservice clusters in Kubernetes, and multi-cloud infrastructure across AWS, Microsoft Azure, and GCP. In this borderless topology, network perimeters have dissolved. The new, definitive control plane of the enterprise is identity. Every single operational transaction—whether accessing an executive ledger, querying a customer database, or committing a code build—begins and ends with an identity verification decision: Who or what is requesting access, under what context, and with what level of cryptographic trust?
Compounding this architectural revolution is a dramatic, largely unmanaged population explosion across corporate networks: the rise of non-human, machine identities.
Today, automated service accounts, microservice API tokens, CI/CD pipeline bots, and autonomous AI agents outnumber human biological employees by an astonishing ratio of 50 to 1. Yet, while enterprise human resources and IT departments enforce rigid onboarding and offboarding rituals for human employees, machine identities frequently linger indefinitely—possessing permanent standing privileges, static credentials, and zero lifecycle oversight. They represent the primary attack vector exploited by sophisticated threat actors to achieve lateral movement and compromise enterprise sovereignty.
Navigating this complex convergence is Gihan Munasinghe, Chief Technology Officer at One Identity. As the engineering visionary guiding one of the world’s most foundational Identity and Access Management (IAM) and Privileged Access Management (PAM) software powerhouses, Munasinghe occupies an authoritative vantage point at the center of enterprise modernization. He is tasked not only with scaling multi-tenant SaaS identity backbones to support hundreds of millions of daily authentications, but also with helping legacy Fortune 500 enterprises modernize decades-old systems without breaking business continuity.
In this landmark executive interview with The Visionary CIOs, Gihan Munasinghe delivers an architectural blueprint for modern Chief Information Officers, Chief Technology Officers, and Chief Information Security Officers. He deconstructs the acute risks of unmanaged machine identities, advocates for the immediate eradication of standing privileges in favor of Just-in-Time (JIT) access, provides an outcome-driven playbook for legacy modernization, reveals his strategic principles for scaling global engineering teams toward 2026, and lays out five non-negotiable tenets for architecting resilient, frictionless Zero Trust environments.
EXECUTIVE DOSSIER & PROFILE
- Executive Name: Gihan Munasinghe
- Current Title: Chief Technology Officer (CTO)
- Enterprise Organization: One Identity
- Specialization: Identity and Access Management (IAM), Privileged Access Management (PAM), Non-Human Machine Identity Governance, Zero Trust Architecture, Legacy Modernization, Hyperscale SaaS Engineering
- Strategic Mandate: Leading global technology strategy, platform engineering, and product innovation across One Identity’s unified identity security portfolio, securing millions of enterprise identities worldwide
- Official Publication: The Visionary CIOs (thevisionarycios.com)
- Editorial Domain: Enterprise Identity Security, Machine Identity Lifecycle, Cloud Platform Modernization
THE COMPREHENSIVE EXECUTIVE INTERVIEW
Q1. As a modern SaaS CTO operating at the helm of global identity security, what represents the most compelling and exciting aspect of your everyday leadership mandate?
GIHAN MUNASINGHE:
What excites me most every single day is the staggering, non-linear velocity of technological evolution.
We have arrived at a moment in software history where the tools, computing substrates, and engineering frameworks at our disposal make it feel as though there is virtually nothing we cannot build. However, as an enterprise SaaS CTO, you quickly realize that this velocity is a profound double-edged sword. As underlying technological capabilities advance, the baseline expectations of enterprise customers escalate in direct correlation.
In today’s SaaS market, attributes that were once celebrated as competitive differentiators—hyperscale horizontal scalability, five-nines (99.999%) platform reliability, millisecond latency, and ironclad cryptographic security—are no longer points of distinction. They are the absolute table stakes of entering the room.
Enterprise customers operating global supply chains or processing billions in daily financial transactions simply assume that your cloud platform will scale effortlessly under load and withstand advanced nation-state cyber attacks. If your identity platform falters, their entire business shuts down.
As SaaS technology leaders, our mandate is not merely to react to current customer demands; we have to maintain a rigorous strategic discipline that stays several steps ahead of systemic market shifts. We must anticipate what distributed enterprises, autonomous systems, and regulatory environments will require three to five years before those needs become critical pain points.
The future is accelerating toward us at an unprecedented tempo. The true thrill of the role lies in building engineering cultures, technical architectures, and operational foundations that are engineered not just to survive that speed, but to thrive within it and redefine customer expectations.
Q2. What are the most critical, non-negotiable architectural pointers surrounding enterprise identity security that technology leaders must address today?
GIHAN MUNASINGHE:
There are two seismic structural realities that every CIO, CTO, and CISO must recognize and architect around immediately:
First, Identity Is the Absolute and Singular Enterprise Perimeter:
With the permanent entrenchment of distributed workforces, hyper-adopted SaaS ecosystems, and hybrid infrastructure spanning multi-cloud clusters and on-premises mainframes, physical network perimeters are completely dead. Historically, network architects relied heavily on physical geography: if a request originated inside the headquarters corporate LAN or an authorized branch office, it was granted default trust.
Today, geographic location is almost entirely irrelevant.
Every single access control evaluation across the modern enterprise must begin with identity: precisely who or what is attempting to authenticate, under what specific behavioral context, using what cryptographic verification, and requesting access to which resource. This means technology leaders can no longer treat “Zero Trust” as a decorative marketing buzzword or a slide in a corporate presentation. Zero Trust—specifically, “Never Trust, Always Verify, Enforce Least Privilege”—must be institutionalized as the default, non-negotiable operating model of the entire enterprise computing fabric.
Second, the Acute Crisis of the 50:1 Machine-to-Human Identity Ratio:
The vast majority of corporate identity programs are still fundamentally engineered around biological humans. Enterprises invest millions in human HR workflows: an employee joins, undergoes identity verification, is assigned a role, and when they depart, their Active Directory or Okta accounts are decommissioned.
Yet, on almost every enterprise network today, non-human, machine identities outnumber human users by a factor of 50 to 1!
We are talking about automated service accounts, microservice-to-microservice API tokens, headless serverless functions, database connection strings, CI/CD pipeline automation bots, and increasingly, autonomous AI agents. These machine entities interact with sensitive customer data, execute financial transactions, alter cloud infrastructure, and possess deep administrative privileges.
What many enterprise boards and IT leaders still dangerously fail to grasp is that machine identities require the exact same—if not greater—lifecycle governance, credential rotation, and least-privilege constraints as human executives. When a developer builds an automated script or deploys a service account, that identity frequently ends up with permanent, standing administrative access that is forgotten for years. When adversaries compromise an environment, they rarely hack their way in; they simply harvest an orphaned machine token and log in with elevated privileges.
This is why I am an uncompromising advocate for the eradication of standing privileges in favor of Just-in-Time (JIT) access. No human administrator—and emphatically no machine agent—should possess perpetual, 24/7 administrative access to critical infrastructure. Access should be ephemeral: requested dynamically, cryptographically verified, bound to a specific operational task, and automatically revoked the microsecond the task concludes. Slashing standing privileges to zero collapses the enterprise attack surface dramatically.
Q3. Modernizing legacy systems is notoriously risky and complex. What does it truly take to modernize legacy enterprise platforms seamlessly without business disruption?
GIHAN MUNASINGHE:
This is one of the most vital strategic questions facing modern enterprises. My first and most emphatic principle is this: never modernize technology simply for the sake of modernizing.
One of the most catastrophic and frequent pitfalls I observe across enterprise IT is when engineering organizations select the newest, trendiest technology stack—whether it is microservices, Rust, Kubernetes, or serverless—before they have clearly defined the business problem they are trying to solve. Adopting bleeding-edge architecture as an end in itself is a recipe for budget blowouts, unmanageable architectural sprawl, and operational failure.
Instead, successful legacy modernization requires a disciplined, outcome-driven playbook built on five pillars:
- Anchor Modernization to a Measurable Business Outcome:
Before writing a single line of code or signing a cloud migration contract, you must define the definitive commercial objective. Are we modernizing to reduce transactional latency by 40%? Are we modernizing to unlock new revenue by exposing legacy mainframe data via real-time customer APIs? Or are we modernizing to slash infrastructure licensing costs? If the business outcome is ambiguous, the initiative will fail. - Build Security, Compliance, and Identity in at Inception:
Legacy systems often rely on “security through obscurity” or physical perimeter isolation. When you modernize a legacy system into an API-driven, cloud-connected architecture, you expose historical technical debt to the public Internet. Identity governance, mutual TLS encryption, tokenization, and regulatory compliance cannot be “retrofitted” after the new architecture is built. They must be architectural prerequisites embedded into the foundational blueprint. - Establish Precise, Quantitative KPIs for Success:
You cannot manage what you do not measure. Establish clear baseline performance metrics before touching the legacy system: throughput, error rates, maintenance overhead, developer onboarding time, and user satisfaction. Measure these continuously throughout the transition to ensure the modernization is actually delivering value. - Engineer for “Fast Failing” via Built-In Architectural Guardrails:
In enterprise architecture, failure is inevitable; catastrophic, undetected failure is what must be prevented. You must design modern systems with built-in telemetry, canary deployments, feature flags, and automated rollback capabilities. If an integration pipeline fails or introduces data corruption, the system should fail fast, alert engineers immediately, and safely revert to the known good state within seconds. The faster you detect an architectural flaw, the cheaper and easier it is to remediate. - Bring All Stakeholders Along Collaboratively:
Modernization is fundamentally an exercise in human change management. The most sophisticated cloud architecture will fail if business operators, customer-facing teams, and end users feel the change is an arbitrary mandate imposed upon them by IT. Technology leaders must engage stakeholders early, articulate the tangible operational benefits, and build collaborative momentum so the transformation feels shared and empowered.
Q4. As enterprise engineering organizations look toward 2026 and beyond, what advice would you share with fellow CTOs on scaling technical teams sustainably?
GIHAN MUNASINGHE:
Having built, scaled, and led high-performing engineering organizations across diverse geopolitical regions, my leadership team and I continually reflect on the foundational mechanics of sustainable growth.
How do you scale an organization dramatically without diluting the elite engineering craft, cultural cohesion, and core values that made the company successful in the first place? How do you keep engineering squads energized and innovative while delivering the rock-solid stability enterprise customers demand?
For me, the guiding philosophy can be captured in several strategic imperatives:
First, Be Relentlessly Intentional with Every Single Hire:
Rapid organizational growth is not inherently dangerous, but chasing headcount as a vanity metric is toxic. It is extraordinarily easy for technology leaders to fall into the trap of believing that throwing more people at an engineering delay will accelerate delivery—a fallacy Fred Brooks warned us about decades ago in The Mythical Man-Month. Headcount alone does not equal progress; often, it simply multiplies communication overhead and organizational drag.
Before expanding the team, focus intensely on optimizing and empowering your existing talent. When you do hire, treat onboarding as a mission-critical engineering discipline. Poorly planned, chaotic onboarding confuses top-tier engineers, breeds cynicism, and corrodes positive engineering culture. An intentional, structured onboarding process equips new hires with deep architectural context, transparent support structures, and the psychological safety needed to deploy code with confidence from their very first sprint.
Second, Architect Systems That Are Designed Steps Ahead of Customer Scale:
In the SaaS ecosystem, platform scaling is not a linear exercise. When an enterprise software company crosses certain market thresholds, customer usage curves accelerate exponentially. If you only design your cloud infrastructure to support today’s user volume plus 10%, you will spend all your time in reactive firefighting when a major enterprise client signs on and floods your platform with millions of concurrent transactions.
True architectural scalability requires anticipating the enterprise’s decadal horizon. You must design distributed data models, caching layers, and asynchronous messaging pipelines that are already capable of supporting an order of magnitude more scale than what customers are currently executing. By designing systems that sit several steps ahead of customer demand, your engineering teams can innovate proactively rather than desperately duct-taping infrastructure in response to unexpected traffic surges.
Q5. In closing, what are the five foundational takeaways you would leave with every CIO, CTO, and CISO navigating enterprise technology today?
GIHAN MUNASINGHE:
I would leave technology and security leaders with five definitive, non-negotiable architectural mandates:
- Zero Trust Must Be the Immutable Structural Foundation:
Zero Trust can no longer be an optional project or a compliance checklist item. It must be the foundational philosophy guiding every line of code written, every API contract defined, and every cloud instance provisioned across your enterprise. Assume breach, verify explicitly, and enforce continuous behavioral validation across every transaction. - Eradicate Standing Privileges via Just-in-Time Access:
Privileged access accounts are the ultimate prize for cyber adversaries. Implement continuous privileged access monitoring and ruthlessly replace 24/7 standing administrative permissions with Just-in-Time (JIT) access models. Grant access ephemerally, constrain it to the minimum required privilege, and revoke it automatically. - Enforce Phishing-Resistant MFA and Accelerate Toward Passwordless:
Traditional passwords and legacy SMS/push-notification multi-factor authentication are hopelessly compromised by modern adversary-in-the-middle (AiTM) phishing kits. Enterprise defense demands the universal adoption of FIDO2-based, hardware-backed, phishing-resistant authentication. Moving toward passwordless workflows eliminates credential theft while simultaneously providing a vastly superior user experience. - Treat the Identity Platform as Critical Enterprise Core Infrastructure:
As enterprises transition to identity-centric architectures, your identity platform becomes the central nervous system of corporate operations. If your identity provider experiences downtime, high latency, or regional failure, every single business application across your enterprise halts. You must architect or select an identity platform built on fault-tolerant distributed systems, multi-region active-active availability, and proven, enterprise-grade scalability. - Always Make the Secure Path the Easiest Path:
This is the golden rule of enterprise security. Security controls that introduce bureaucratic drag, cumbersome approvals, and productivity friction will invariably be circumvented. Developers and business units will invent shadow workarounds that completely undermine the protections you designed. The true genius of cybersecurity engineering is not creating high walls; it is engineering elegant, intuitive, and frictionless systems where the most secure operational path is also the fastest, simplest, and most natural path for employees to get their work done.
