TL;DR: Akeyless says machine identities now outnumber human identities by 45x, alongside a 240% rise in digital identities in 2023 and enterprises with 10,000 employees managing nearly half a million machines. That scale makes static secrets, certificates, and tool sprawl a lifecycle governance problem, not a perimeter problem.
At a glance
What this is: This is a vendor-published fireside chat on machine identity growth and the operational strain it places on traditional cybersecurity models.
Why it matters: It matters because identity teams have to govern far more machine identities, secrets, and certificates than human accounts, and legacy controls break when scale and lifecycle complexity outpace manual oversight.
By the numbers:
- Machine identities now outnumber human identities by 45x, according to Akeyless.
- Akeyless cited a 240% rise in digital identities in 2023.
👉 Read Akeyless's analysis of machine identity scale and legacy cybersecurity limits
Context
Machine identity scale is the widening gap between the number of non-human identities and the controls most organisations still use to govern them. In this discussion, Akeyless frames that gap around machine identities, secrets, certificates, and the operational load created when those elements multiply faster than lifecycle processes can keep up.
The core governance problem is not just more assets, but more identity state to manage across creation, use, rotation, and retirement. When static credentials and certificates remain in place for long-lived machine workloads, the attack surface expands and accountability becomes harder to maintain.
The article positions that problem as a scaling issue that is already visible in enterprise environments, not a future-state concern. For identity programmes, the relevant question is how to keep machine identity governance aligned with the rate at which infrastructure, automation, and services expand.
Key questions
Q: How should security teams govern machine identities in industrial environments?
A: Security teams should govern machine identities the same way they govern privileged access: assign an owner, define a specific purpose, limit scope, and review it continuously. In practice, that means tracking service accounts, certificates, APIs, and connectors as non-human identities with their own lifecycle, not as background infrastructure. A machine identity should never have broader access than its workflow requires.
Q: Why do static credentials increase risk in engineering environments?
A: Static credentials persist beyond the work they were created for, which makes them easy to copy, hardcode, share, or forget during offboarding. That persistence creates a larger attack window and a slower revocation process, especially across distributed infrastructure and multi-cloud estates.
Q: What breaks when identity governance is spread across too many vendor tools?
A: Lifecycle operations become inconsistent, audit trails become incomplete and deprovisioning becomes slower. That increases the chance that access remains active after it should have been removed, which is especially dangerous for high-value accounts, service identities and users with broad delegated access.
Q: What should teams do first when machine identities outnumber human accounts?
A: Start with an inventory of all machine identities, then rank them by business criticality and credential lifetime. That gives you a practical way to target the highest-risk secrets and certificates first, instead of trying to remediate the entire estate at once.
Technical breakdown
Why machine identity scale breaks legacy control models
Legacy cybersecurity models were built around bounded human populations and relatively stable access patterns. Machine identities behave differently: they are created by systems, consumed by systems, and often remain active far longer than the workload that needed them. That changes the control problem from occasional account oversight to continuous lifecycle governance across secrets, certificates, and service credentials. Once machine identity counts rise sharply, manual review, ad hoc rotation, and isolated vaults stop providing reliable coverage because the identity estate grows faster than operational teams can reconcile it.
Practical implication: Treat machine identity governance as a lifecycle programme, not a tool deployment.
Static secrets and certificates as a persistent attack surface
Static machine identities become attractive targets because they are reusable, portable, and often difficult to distinguish from legitimate service traffic. Passwords, API keys, and certificates can persist well beyond the context in which they were issued, which creates a wide exposure window if they are copied, logged, or reused. The technical issue is not the existence of secrets alone but their longevity and spread across environments. At scale, every extra secret is another object that can leak, be reused, or outlive the workload that depends on it.
Practical implication: Reduce the number of reusable machine secrets that remain valid across multiple workflows.
Why integrated machine identity governance matters
As machine identities expand, fragmented control planes create blind spots between secrets management, certificate lifecycle management, remote access, and key management. The more separate tools you add, the harder it becomes to trace ownership, enforce consistent rotation, and prove that old credentials were retired on time. Integrated governance matters because identity state is only useful when issuance, usage, and revocation are all visible in the same operating model. Without that, teams end up detecting problems after trust has already been extended too broadly.
Practical implication: Unify issuance, rotation, and revocation tracking across the full machine identity estate.
Threat narrative
Attacker objective: The attacker aims to abuse machine credentials and certificates to extend trusted access across systems and services.
- Entry begins when attackers target static machine identities such as passwords, credentials, and certificates that can be reused outside their original context.
- Escalation occurs when those identities grant standing access to systems or services that were never designed for short-lived, tightly scoped access.
- Impact follows when compromised machine identities allow broader trust abuse, data access, or operational disruption across connected environments.
Breaches seen in the wild
- United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Machine identity scale has become a governance problem before it becomes a tooling problem. When enterprises reach hundreds of thousands of machines, the issue is no longer whether a vault exists, but whether the identity programme can continuously account for creation, usage, rotation, and retirement across all non-human identities. That scale changes machine identity from a point control into an operating model issue. The practitioner conclusion is simple: lifecycle discipline now matters more than isolated protection.
Static credential trust debt is the right way to describe this category. Passwords, certificates, and other reusable machine secrets accumulate hidden risk the longer they remain valid, because each one carries an untracked dependency on the workload, pipeline, or service that uses it. This is not just secret sprawl, it is deferred governance that compounds over time. Practitioners should read that as a signal that standing trust is becoming operationally expensive.
Integrated identity controls are now the only scalable way to govern machine trust. When secrets management, certificate lifecycle management, and privileged access live in separate silos, no one system can answer who owns a machine identity, where it is used, or whether it was retired on time. That weakens assurance and slows response when an identity is exposed. The practical conclusion is that machine identity governance must be designed as one control plane, not many disconnected ones.
The security workforce constraint is part of the problem, not just the backdrop. The article’s emphasis on tool proliferation and simplicity reflects a reality practitioners already know: operational teams cannot manually absorb identity growth at machine speed. That makes governance quality depend on automation, policy consistency, and clear ownership, not just on adding more products. For identity leaders, the question is whether the operating model can scale with infrastructure growth.
Machine identity is now a core identity programme concern, not a niche infrastructure topic. Once non-human identities outnumber humans by orders of magnitude, they shape breach exposure, auditability, and trust decisions across the enterprise. That places them firmly inside the remit of IAM, PAM, and lifecycle governance teams. Practitioners should stop treating machine identity as an edge case and start treating it as a primary identity class.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
- Read next: Guide to NHI Rotation Challenges
What this signals
Credential sprawl is the real scaling limit. Once machine identities multiply faster than the teams that govern them, the control problem shifts from protecting a handful of high-value secrets to reducing the number of reusable credentials that must be tracked across environments. That is why machine identity programmes should be measured by how much standing trust they remove, not by how many vaults they deploy.
Machine identity governance now sits inside broader identity lifecycle design. The same programme disciplines that govern joiner, mover, and leaver processes for humans have to be adapted for service accounts, certificates, and workload credentials. If you do not define issuance, ownership, and offboarding for machine identities, the organisation will keep inheriting trust it no longer understands.
For practitioners
- Map the machine identity estate Inventory service accounts, API keys, certificates, and workload credentials across cloud and on-premises environments, then assign an owner and renewal path to each one.
- Shorten the lifetime of reusable secrets Replace long-lived machine credentials with short-lived issuance wherever workloads support it, and define explicit expiry for every credential class that cannot yet be removed.
- Consolidate lifecycle control points Align secrets management, certificate lifecycle management, and privileged access workflows so that issuance, rotation, and revocation are governed together.
- Baseline machine growth against operating capacity Compare machine count growth with the team’s ability to review ownership, rotate credentials, and retire unused identities without backlog.
Key takeaways
- Machine identity growth is outpacing the governance models many enterprises still use, and that mismatch creates lasting exposure.
- Static machine secrets and certificates expand attack surface because they are reusable, long-lived, and difficult to govern at scale.
- Practitioners need one lifecycle model for machine identities, with clear ownership, rotation, and retirement controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Static machine identities often carry broader access than the workload needs. |
| NHI-07 — Long-Lived Secrets | The article centres on reusable machine secrets that remain valid too long at scale. | |
| NHI-01 — Improper Offboarding | Machine identities must be retired when workloads or services change, or trust persists too long. | |
| Recommendation — Review machine credentials for excessive scope and remove standing privilege wherever possible. Replace long-lived machine secrets with short-lived credentials and enforce expiry on all residual exceptions. Tie workload decommissioning to machine credential revocation and certificate retirement. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential lifecycle management is central to the article's machine identity problem. |
| Recommendation — Apply Authenticator Management to rotate, replace, and revoke machine credentials on a governed schedule. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Machine identity scale changes how permissions and entitlements must be tracked. |
| Recommendation — Continuously validate machine identity entitlements against current workload need and remove stale access. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article is about managing the lifecycle of a growing machine account population. |
| Recommendation — Standardise account inventory, ownership, and deprovisioning for all machine identities. | ||
Key terms
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Static Secret: A secret, such as an API key or password, that does not change automatically over time. Static secrets require manual or scheduled rotation and represent a higher security risk than dynamic secrets or managed identities.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
What's in the full article
Akeyless's full post covers the operational detail this post intentionally leaves for the source:
- The specific machine identity and secrets management capabilities described in the fireside chat
- A fuller explanation of Akeyless's vaultless design, dynamic secrets, and secretless authentication approach
- The leadership commentary on tool sprawl, complexity reduction, and how organisations can simplify machine identity operations
- The original discussion with Admiral Mike Rogers and Oded Hareven on cybersecurity scale and operational priorities
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org