25,000 GitHub stars signal growing demand for identity security platforms

At a glance

What this is: This is Infisical's update on crossing 25,000 GitHub stars, which it interprets as evidence that engineers are adopting a broader identity security platform for secrets, certificates, PAM, scanning, and AI agent access.

Why it matters: It matters because IAM, NHI, and infrastructure security teams are being pushed toward shared governance for machine access, certificates, and agent interactions instead of managing those controls as separate point problems.

Context

The primary issue here is not the GitHub milestone itself, but what it suggests about how teams are approaching identity security for infrastructure and machine access. As environments grow more dependent on secrets, certificates, privileged access, and AI-driven automation, the control problem shifts from isolated credential handling to unified governance across the stack.

Infisical positions the milestone as evidence that operators want a platform that can cover secrets management, certificate management, PAM, secrets scanning, and AI agent security in one operating model. That framing reflects a broader IAM trend: when identity is embedded in workloads, pipelines, and agentic systems, the governance model has to follow the execution path rather than sit beside it.

Key questions

Q: How should teams govern secrets, certificates, and PAM in one programme?

A: Treat them as one identity security lifecycle, not as separate tooling categories. The practical test is whether ownership, rotation, expiry, revocation, and audit evidence are consistent across every asset that can authenticate to production. If those controls live in different processes, governance will fragment at the point where systems start depending on each other most.

Q: Why do organisations want a single control plane for identity security?

A: Because separate tools often hide the relationships between secrets, certificates, privileged access, and runtime systems. A single control plane does not remove complexity, but it can make policy enforcement and audit trails consistent enough to see cross-domain drift. That matters when access is distributed across infrastructure, pipelines, and automation.

Q: What breaks when AI agents have production access without containment?

A: What breaks is the assumption that identity permission alone is enough to control impact. If an AI agent can reach production systems directly, one mistaken action can delete environments, modify configurations, or disrupt services before review processes can intervene. Containment must limit where the permission can be exercised, not just what the identity is allowed to request.

Q: How should security teams evaluate a data security platform against identity risk?

A: They should test whether the platform can join sensitive-data findings to identity context, including account type, privilege level, and recent access activity. A platform that only discovers data but cannot explain who can reach it will improve reporting more than containment. The real test is whether it helps reduce standing privilege and narrow the blast radius of exposed data.

Technical breakdown

Why unified control planes matter for secrets and certificates

Secrets management and certificate management solve adjacent but distinct identity problems. Secrets authenticate workloads and services, while certificates provide cryptographic trust for machine-to-machine interactions. In practice, teams often struggle because these assets are created, rotated, and consumed in different systems with different owners and audit trails. A unified control plane reduces that fragmentation by making identity posture visible across issuance, access, and revocation. That matters most in production environments where credential sprawl and certificate drift create blind spots faster than manual review can close them.

Practical implication: map secrets and certificate ownership to one governance model so lifecycle controls do not split across tools.

How PAM changes when the subject is not a human user

Privileged access management is no longer only about admin consoles and human session control. In infrastructure-heavy environments, elevated access can also sit with automation, service identities, and operational workflows that need tightly scoped privileges without standing access. That changes the governance question from who logged in to what identity was allowed to act, for how long, and under which policy. When PAM is extended into machine and workload access, it becomes part of identity lifecycle governance rather than a separate human admin control.

Practical implication: govern elevated access for service identities with the same approval, scope, and expiry discipline used for human privilege.

AI agent security turns identity governance into runtime governance

AI agents and MCP servers add a new layer because they may authenticate, request tools, and reach sensitive systems on behalf of operators or workflows. The key issue is not just whether an agent has credentials, but whether its access is bounded by policy, observable in audit logs, and revocable when context changes. That makes identity governance more dynamic than classic workload IAM. If the agent can choose actions at runtime, then issuance, authorization, and logging all have to be evaluated as a single control path rather than separate administrative tasks.

Practical implication: treat agent authentication and tool access as one governance flow, not as disconnected IAM and application-security checks.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

25,000 stars are a proxy for governance convergence, not product popularity. The meaningful signal is that operators are rewarding platforms that collapse secrets, certificates, PAM, and scanning into one control model. That indicates the market is moving away from fragmented identity tooling and toward shared governance over infrastructure access. Practitioners should read that as a category shift in how identity security is being operationalised.

Identity security is becoming an infrastructure control plane problem. Once secrets and certificates are managed alongside access controls, the security issue is no longer only credential hygiene. It becomes policy consistency, auditability, and lifecycle ownership across every system that can authenticate to production. Teams that still run separate point controls for each identity asset will continue to miss cross-domain drift.

AI agent security is pulling identity governance into runtime behaviour. Agent access is not just another account type because the access pattern can change during execution. That pushes governance beyond static entitlement review and into continuous policy enforcement over authentication, tool access, and delegation. The implication is that identity programmes need to account for runtime decision paths, not just stored credentials.

One dashboard, one audit trail is the right objective only if policy unification is real. A single interface does not automatically create unified governance, but it does expose whether the underlying controls are actually aligned. The useful benchmark is whether teams can trace secrets, certificates, privileged actions, and agent access through the same policy lineage. Practitioners should evaluate platforms on that lineage, not on surface consolidation alone.

Platform convergence is validating a broader identity security operating model. The more infrastructure teams centralise access governance, the less room there is for isolated lifecycle practices that treat secrets, machine access, and privileged operations as separate disciplines. That favours programme designs that connect IAM, NHI governance, and privileged access under one operational ownership model. The takeaway is to plan for convergence, because operators are already voting for it.

What this signals

Platform convergence is now the baseline expectation for identity security programmes. Teams should expect governance pressure to move from point controls toward shared policy layers that cover secrets, certificate trust, privileged access, and machine-to-machine authentication. That shift is especially important where one workflow spans multiple identity assets and ownership boundaries.

AI agent access will force identity teams to think in terms of runtime governance. Once agents can authenticate and act inside production systems, static entitlement models stop being enough on their own. The programme question becomes whether access can be observed and revoked at the same speed as the agent’s execution path.

For practitioners

• Standardise ownership for machine credentials Assign named owners to secrets, certificates, and privileged machine accounts so rotation, revocation, and exception handling follow one lifecycle model.
• Unify audit trails across identity assets Correlate issuance, authentication, privilege changes, and revocation events across secrets, PKI, and PAM so investigators can reconstruct one access path.
• Extend PAM governance to non-human actors Apply approval, scope, and expiry rules to service identities and automation paths that can reach sensitive systems, not just to human admins.
• Review agent authentication before scaling AI workflows Document which AI agents and MCP servers can authenticate to production, what they can access, and how access is revoked when context changes.

Key takeaways

• The article is really about category convergence, with operators rewarding platforms that connect secrets, certificates, PAM, scanning, and AI agent access under one governance model.
• The GitHub milestone is used as evidence of sustained operator interest, not casual adoption, and Infisical ties that interest to production use across infrastructure teams.
• For practitioners, the main implication is to evaluate whether identity controls are managed as one lifecycle across machine, privileged, and agentic access rather than as separate tools.

Key terms

• Identity Security Platformisation: The consolidation of identity capabilities such as IAM, PAM, secrets, and NHI functions into a single operating model. It can simplify procurement and visibility, but it also risks blurring control ownership unless enforcement, evidence, and lifecycle responsibilities remain separate and testable.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.
• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.