TL;DR: As machines, APIs, bots, and IoT devices outnumber human users, SPHERE argues that non-human identities are becoming a primary cybersecurity blind spot, with attackers exploiting weak ownership, poor visibility, and inadequate entitlement oversight. The governance model now has to shift from account inventory to identity intelligence, or NHI risk will keep outrunning conventional IAM controls.
At a glance
What this is: This is SPHERE's analysis of how exponential NHI growth is widening identity governance blind spots across machines, APIs, bots, and IoT devices.
Why it matters: It matters because IAM programmes that still centre humans will miss ownership, entitlement, and monitoring gaps that now define NHI risk at enterprise scale.
Context
Non-human identity sprawl is the expansion of machine, service, API, bot, and device identities faster than organisations can govern them. In this article, SPHERE argues that the real issue is not just the count of NHIs but the governance blind spots that appear when traditional IAM models remain human-centric.
That creates a lifecycle problem for identity teams: many NHIs do not have clear owners, consistent entitlement review, or reliable monitoring of certificate and key use. The result is a governance surface that keeps growing even when human identity controls appear mature.
Key questions
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access. That creates orphaned identities, stale credentials, and broad permissions that persist because the organisation cannot prove what depends on them. The result is a growing attack surface with no accountable decision-maker.
Q: Why do machine identities create more risk than human identities in some environments?
A: Machine identities are often numerous, long-lived, and embedded in code or infrastructure. They are harder to review manually, easier to overlook during offboarding, and more likely to carry excessive privilege. That combination increases blast radius when a secret or token is exposed.
Q: How do teams know if NHI governance is actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and reliable decommissioning. If new credentials appear faster than they are classified, or if stale secrets stay valid after workload changes, the programme is not governing machine identities effectively.
Q: What is the difference between inventory and identity intelligence for NHIs?
A: Inventory lists what exists. Identity intelligence connects each NHI to ownership, entitlement context, usage patterns, and lifecycle state, so security teams can judge whether access still makes sense. For machine identities, that distinction matters because a static list does not show whether an identity is active, abandoned, or overprivileged.
Technical breakdown
Why NHI ownership breaks traditional IAM models
Traditional IAM assumes an identity can be owned, reviewed, and retired through human-centric processes. NHIs challenge that assumption because the subject may be a bot, API, device, or service with no natural business owner and no obvious manager to receive review tasks. Without a named owner, entitlement decisions, certificate renewal, SSH key management, and exception handling become fragmented across teams. That fragmentation is not just administrative friction. It creates a durable visibility gap that attackers can exploit because nobody is accountable for the identity's full lifecycle.
Practical implication: assign explicit ownership for every NHI and make ownership part of inventory, review, and offboarding workflows.
Why entitlement review fails when identities are machines
Entitlement auditing works best when access is bounded, stable, and understandable to a reviewer. NHIs often accumulate privileges for integrations, automation jobs, and infrastructure tasks that are hard to interpret in business terms. Over time, those entitlements drift away from the original use case, especially when services are reconfigured but credentials remain live. The article's core governance warning is that entitlement lists alone are not enough. Teams need identity intelligence that links privileges to function, usage, and accountability, not just to an account record.
Practical implication: map each NHI entitlement back to a defined workload or service purpose before certifying it.
How certificates, SSH keys, and behavioral signals change the control model
NHIs are governed through different control primitives than humans. Certificates, SSH keys, API tokens, and behavioral telemetry become the practical evidence of trust, use, and abnormality. That shifts the control model away from passwords and user authentication flows toward rotation, monitoring, and anomaly detection tied to machine behaviour. The article's point is that traditional identity frameworks often exclude these artifacts, even though they are the real trust anchors for NHIs. When those artifacts are unmanaged, access can persist invisibly long after the original need has changed.
Practical implication: treat machine credentials and behavioural monitoring as primary governance data, not secondary security telemetry.
Threat narrative
Attacker objective: Attackers aim to exploit unmanaged machine identities to gain persistent access, amplify attack capacity, and increase breach reach without triggering human-centric controls.
- Entry occurs through overlooked non-human identities such as bots, APIs, and IoT devices that sit outside normal identity governance.
- Escalation follows when weak ownership and poor entitlement oversight leave excessive access in place longer than intended.
- Impact emerges at scale because compromised NHIs can support botnets, distributed denial-of-service activity, and broader breach amplification.
Breaches seen in the wild
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
- New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
NHI ownership is now the control plane, not a back-office detail. When machines, bots, APIs, and devices outnumber people, ownership determines whether an identity can be reviewed, revoked, or investigated at all. SPHERE's argument is directionally correct: the first governance failure is not weak policy but unclear accountability. Practitioners should treat ownership mapping as a foundational control for every NHI programme.
Identity intelligence is the missing layer between inventory and governance. Inventory tells you what exists, but it does not tell you whether the identity is active, expected, or still aligned to a business function. That is why entitlement auditing without behavioural context produces false confidence. The practical conclusion is that NHI programmes need relationship data, usage data, and lifecycle data together.
The NHI risk model is shifting from isolated accounts to distributed trust surfaces. Certificates, SSH keys, tokens, and service credentials are the real trust anchors for machine identities, which means governance has to extend beyond classic IAM objects. This is where OWASP-NHI concerns and Zero Trust thinking converge: trust must be continuously evidenced, not assumed from account creation. Practitioners should reframe machine identity as an infrastructure-wide governance problem.
Visibility blind spots are the real breach multiplier. The article's central warning is that attackers do not need every NHI to be vulnerable, only the identities that no one is watching. That is why unmanaged privilege, weak monitoring, and unclear lifecycle ownership compound into systemic exposure. The practitioner takeaway is straightforward: if you cannot explain who owns an NHI and why it still has access, you do not govern it.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Identity sprawl changes the control target. Once non-human identities outnumber humans, IAM teams cannot rely on user-centric workflows to keep pace. The programme has to move from simple account discovery toward governed ownership, entitlement context, and lifecycle evidence across machine identities.
Visibility is now a governance requirement, not a reporting feature. If a security team cannot tell which service account or API token still has business justification, it is already behind. That is why machine identity governance needs continuous relationship mapping rather than periodic clean-up campaigns.
For practitioners
- Build a complete NHI ownership map Tie every bot, API, device, and service account to a named business or technical owner, then make ownership a required field for review and offboarding.
- Audit entitlements against real service purpose Certify NHI access by linking each privilege set to the workload, integration, or automation task it supports, and remove access that lacks an active use case.
- Track certificates, keys, and tokens as governance objects Treat machine credentials as lifecycle assets that need rotation, revocation, and exception handling, not as static technical details buried in configuration.
- Add behavioural monitoring for abnormal NHI use Watch for unexpected usage patterns, dormant identities that suddenly activate, and access that exceeds the documented function of the identity.
- Separate human IAM controls from NHI governance Do not assume human onboarding, attestation, and password-centric processes will cover machine identities; build NHI-specific inventory and review paths instead.
Key takeaways
- Non-human identities have become a governance blind spot because traditional IAM models still prioritise human accounts and human review patterns.
- Attackers can turn overlooked machine identities into large-scale availability or breach impact, especially when ownership and entitlement oversight are weak.
- The control that matters most is traceable accountability across the NHI lifecycle, including ownership mapping, entitlement review, and credential governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Unowned NHIs cannot be cleanly retired or revoked when they outlive their business purpose. |
| NHI-05 — Overprivileged NHI | The article centres on excess NHI entitlement and weak oversight of machine access. | |
| NHI-02 — Secret Leakage | NHIs depend on certificates, keys, and tokens that become governance failures when unmanaged or exposed. | |
| Recommendation — Map each NHI to an offboarding path and revoke identities that no longer have an active owner or use case. Review NHI entitlements against actual workload need and remove privileges that exceed documented function. Inventory and monitor machine credentials so exposed or stale secrets can be revoked before reuse. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | NHI entitlement review is central to the governance gap SPHERE describes. |
| Recommendation — Align NHI access reviews to PR.AA-05 by validating entitlements against current business need. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article is fundamentally about unmanaged accounts and incomplete ownership across machine identities. |
| Recommendation — Apply account management controls to ensure every NHI is created, reviewed, and removed under clear ownership. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificates, SSH keys, and other machine authenticators are the operational trust anchors in the article. |
| Recommendation — Use IA-5 to govern rotation, renewal, and revocation of NHI authenticators on a defined lifecycle. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Identity Intelligence: Identity intelligence is the layer that turns raw identity data into context about risk, usage, and privilege. It helps teams distinguish harmless access from materially risky access by linking identity records, entitlement patterns, and behavioural signals, which is essential when non-human identities scale faster than manual review.
- Entitlement Audit: An entitlement audit is the process of reviewing what access an identity has and deciding whether that access is still necessary. For NHI programmes, the review must be tied to workload function, not just account existence. Otherwise, stale privileges can survive long after the service they were meant to support has changed.
- Machine Credential: A machine credential is a secret or identity artifact used by software rather than a person. It includes service account credentials, API keys, tokens, and certificates. In practice, the main risk is not just exposure, but unmanaged lifecycle, unclear ownership, and overbroad access.
Deepen your knowledge
NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org