Identity and access management tools now must govern NHIs

At a glance

What this is: This article argues that modern IAM must extend beyond human login controls to govern NHIs, standing privilege, and time-bound access across cloud, CI/CD, and SaaS environments.

Why it matters: IAM and identity security teams need to treat NHI governance as part of core access architecture, because over-permissioned machine identities now shape blast radius as much as human accounts do.

By the numbers:

• 78% of organizations plan to ramp up spending on identity and access management tools to ease concerns over identity-based attacks that lead to phishing and lateral movement.

Context

Identity and access management tools now have to govern more than human sign-ins. As cloud footprints expand, the access problem shifts toward CI/CD pipelines, service accounts, API tokens, and AI-powered agents that need controlled access to production systems and sensitive data.

The governance gap is not authentication alone. The article's core argument is that IAM programmes must control standing privilege, entitlements, and ephemeral access for both humans and NHIs, because broad cloud sprawl turns unmanaged access into persistent exposure.

Key questions

Q: How should security teams govern NHIs inside IAM programmes?

A: Security teams should treat NHIs as part of the main access estate, not as an afterthought to human IAM. That means inventorying service accounts, tokens, pipelines, and bots, then applying ownership, least privilege, lifecycle control, and revocation rules that match the risk of the systems they touch.

Q: Why do standing privileges become more dangerous in multi-cloud environments?

A: Because each cloud can accumulate excess rights independently, so a role that looks acceptable in one platform may still create lateral movement risk when combined with access in another. Standing privilege also extends the window in which stale access can be reused, which is especially risky in regulated environments with multiple audit obligations.

Q: What breaks when access reviews do not include machine and AI identities?

A: Review cycles miss the identities that often move the most data and inherit the most privilege. As a result, excessive access can persist in service accounts, pipelines, and AI-connected workflows even when human user access looks clean. The control fails because the review scope is too narrow for the actual access graph.

Q: Should organisations prioritise JIT access over broad entitlement cleanup?

A: Organisations should prioritise JIT access when the immediate problem is persistent operational privilege, because it directly shortens the exposure window. Entitlement cleanup still matters, but JIT changes day-to-day risk faster by ensuring access exists only when the task requires it.

Technical breakdown

Why IAM now has to govern NHIs

IAM tools still answer the basic questions of who is authenticating and what they can do, but that model breaks down when the identity is a workload, pipeline, or bot. These actors do not behave like employees with stable logins and predictable sessions. They consume secrets, assume roles, and touch production through automated paths that can outlive the task that created them. That makes the access problem one of lifecycle, scope, and revocation, not just authentication. Practical implication: model NHIs as first-class identities in IAM and not as edge cases attached to human workflows.

Practical implication: treat NHIs as first-class identities in IAM, with explicit lifecycle and entitlement governance.

Why standing privilege is the real exposure

The article points to standing privilege as the main operational weakness in cloud-native environments. When access is always on, a compromise does not need to wait for a ticket, approval, or human sign-in event. The attacker only needs a valid identity with more privilege than the task requires. Time-bound access and JIT controls reduce the window, but the deeper issue is that persistent entitlements make access review and least privilege drift apart. Practical implication: design privilege around task scope and duration rather than around account ownership.

Practical implication: replace persistent entitlements with task-scoped access and revoke anything that remains idle between uses.

How secrets, tokens, and certificates expand the IAM boundary

IAM in this article is not limited to directories and login prompts. It includes the credentials NHIs use to authenticate, such as API keys, tokens, and certificates. Once those secrets are scattered through CI/CD systems, config files, and runtime environments, access control becomes inseparable from secrets management. A tool that can see permissions but not the secrets that activate them cannot govern the full attack surface. Practical implication: align IAM, PAM, and secrets governance so that identity scope and credential scope are managed together.

Practical implication: align IAM, PAM, and secrets management so that identity scope and credential scope are governed together.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• CI/CD pipeline exploitation case study: Credentials in an exposed .git/config let a researcher edit a Bitbucket pipeline so it planted their SSH key on the server. No victim was named.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

NHI governance is now an IAM core requirement, not a niche add-on. The article describes a world where access is no longer dominated by employee accounts but by pipelines, service accounts, tokens, and bots. That changes the centre of gravity for identity programmes, because unmanaged NHIs can create the same or greater exposure than human users. The practitioner conclusion is straightforward: if IAM does not govern NHIs, it is not governing the actual access estate.

Standing privilege is the control failure that turns cloud sprawl into persistent exposure. Automated environments create too many durable identities that keep broad permissions long after the original need has passed. JIT and time-bound access matter because they convert privilege from a default condition into a temporary state. The implication is that access governance has to be designed around duration and task scope, not static entitlement ownership.

Identity governance now spans IAM, PAM, and secrets management as one control plane. The article shows that authentication, privileged access, and credential storage are no longer separable layers when NHIs are involved. A token or certificate is not just a secret, it is the mechanism that activates access. Practitioners should treat credential scope, privilege scope, and revocation scope as one governance problem.

Time-bound access is becoming the operational expression of Zero Trust for non-human identities. In cloud-native environments, least privilege only works when access expires with the task and can be reissued under policy. That makes orchestration, auditability, and revocation the practical test of whether Zero Trust is real or rhetorical. The conclusion for programmes is that NHI governance must be measurable in entitlement lifetime, not policy intent.

From our research library:

• 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
• Read next: Guide to NHI Rotation Challenges

What this signals

Identity sprawl is now an access-governance problem, not just an inventory problem. When pipelines, service accounts, and tokens keep multiplying, the real failure is not discovery alone but the inability to bind each identity to a clear owner, purpose, and expiry condition. Teams that still review access on a human-centric cadence will miss the identities that matter most to production risk.

Standing privilege has become the practical enemy of least privilege. The operational test is whether access can be granted, used, and removed in the same workflow without leaving residual privilege behind. If not, cloud scale turns every emergency exception and automation shortcut into durable exposure that no quarterly review can fully unwind.

For practitioners

• Map non-human identities into the IAM inventory Inventory CI/CD pipelines, service accounts, API tokens, certificates, and bots alongside human identities so access reviews cover the real estate being used in production.
• Replace standing privilege with time-bound access Use JIT and just-enough privilege for operational access, especially where cloud providers, internal tools, and production systems are touched by automation.
• Tie secrets governance to entitlement governance Treat API keys, tokens, and certificates as governed access assets, with rotation, ownership, and revocation aligned to the identities that use them.
• Build access flows into engineer workflows Embed approvals and policy checks into Slack, Teams, CLI, and deployment pipelines so governance happens where requests originate instead of in ticket queues.

Key takeaways

• IAM now has to govern non-human identities such as pipelines, service accounts, tokens, and bots as part of the core access estate.
• Cloud sprawl and standing privilege together create the exposure window that attackers exploit through identity-based attacks.
• JIT access, entitlement governance, and secrets control are the practical levers that reduce that risk in cloud-native environments.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Secrets Management: The discipline of securely storing, distributing, rotating, and auditing secrets across an organisation's systems and pipelines, typically implemented via a centralised secrets vault such as HashiCorp Vault, AWS Secrets Manager, or Akeyless.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.