TL;DR: Non-human identities are expanding faster than governance can track, with 82 to 1 NHI-to-human ratios in early 2025, 77% of organisations treating undiscovered machine identities as latent vulnerabilities, and 50% reporting NHI-linked breaches in the past twelve months, according to Soffid research. The real failure is assuming machine access can be governed like human access when ownership, rotation, and monitoring are still missing.
At a glance
What this is: This is an analysis of how unmanaged non-human identities are widening the attack surface, with the article arguing that visibility, ownership, rotation, and monitoring are still lagging behind NHI growth.
Why it matters: It matters because IAM, PAM, and IGA programmes still built around human-centric assumptions will miss the machine credentials, service accounts, tokens, and certificates that now carry real access risk.
By the numbers:
- Non-human identities outnumbered human users by a ratio of 82 to 1 in the first half of 2025, according to CyberArk.
- 77% of organisations acknowledge that every undiscovered machine identity is a latent vulnerability, according to CyberArk.
- 50% of organisations have suffered breaches linked to non-human identities in the past twelve months, according to NHIMG.
Context
Non-human identity blind spots are an IAM governance problem first, and a threat problem second. API keys, service accounts, tokens, and certificates can authenticate systems without a person in the loop, which means they often sit outside the ownership, review, and monitoring model built for human users.
The article argues that the control gap is visibility: once NHIs are spread across cloud services, third-party integrations, and AI-adjacent workflows, they become difficult to inventory and even harder to govern consistently. That makes unmanaged machine access a durable attack surface rather than a narrow configuration issue.
The article also frames the starting point as typical for organisations that have grown their machine estate faster than their identity programme. That is increasingly common, not exceptional.
Key questions
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access. That creates orphaned identities, stale credentials, and broad permissions that persist because the organisation cannot prove what depends on them. The result is a growing attack surface with no accountable decision-maker.
Q: Why do undiscovered machine identities create so much risk?
A: Undiscovered machine identities create risk because they can remain active outside normal review cycles while still carrying access to production systems. Without visibility, organisations cannot rotate, revoke, or monitor them effectively, so exposure lasts longer than intended. The danger is not just the secret itself but the ungoverned access path attached to it.
Q: How can security teams reduce the attack surface created by NHIs?
A: Security teams reduce NHI attack surface by combining inventory, vaulting, rotation, least privilege, and continuous monitoring in one governance model. That prevents machine credentials from drifting into shadow access and makes it easier to remove secrets that no longer support a live workload or integration. Fragmented controls leave gaps between creation, use, and revocation.
Q: What is the difference between human identity governance and NHI governance?
A: Human identity governance focuses on onboarding, role changes, and access reviews for people. NHI governance must also manage machine-to-machine trust, secret rotation, token reuse, and identity retirement across systems. The practical difference is that machine identities need automated lifecycle controls, not just periodic attestations.
Technical breakdown
Why non-human identities become invisible in IAM stacks
Non-human identities are machine credentials used by services, applications, and automated systems to authenticate and exchange data without human intervention. The technical problem is not that they exist, but that they often emerge outside standard joiner-mover-leaver processes, live in separate tools, and accumulate without a durable owner. Once that happens, inventory, lifecycle, and access decisions become fragmented. A credential can remain active even when the workload, integration, or project that created it has changed. That is why NHI governance is not just about storing secrets, but about making every machine identity discoverable, attributable, and reviewable across the identity estate.
Practical implication: build a complete NHI inventory before trying to tighten access policies.
Why credentials, not workloads, are the real control point
The article groups API keys, service accounts, tokens, and certificates together because each represents an authentication artefact that can outlive the workload that uses it. In practice, compromise often happens through the credential layer rather than the application layer. If a machine identity is overprivileged, long-lived, or reused, the attacker does not need to defeat the workload itself. They can use the credential as a standing path to the resource. That is why vaulting, rotation, and least privilege matter together: they reduce both exposure duration and the amount of access attached to any one secret.
Practical implication: treat credential lifetime and privilege scope as the primary NHI risk variables.
How centralised governance changes the NHI attack surface
A central identity engine changes the operating model by making NHIs part of the same governance plane as human identities. The article contrasts this with standalone tooling, where secrets can be stored or rotated without consistent policy enforcement, logging, or access review. When PAM, IGA, and detection share the same control layer, anomalous use is easier to spot and offboarding becomes less dependent on local tool ownership. The key point is not the tool stack itself, but whether policy follows the identity across systems. Without that, NHIs remain administratively visible but operationally unmanaged.
Practical implication: align PAM, IGA, and monitoring around one identity control plane for humans and machines.
Threat narrative
Attacker objective: The attacker wants durable access through a machine identity path that bypasses human-facing controls and review cycles.
- Entry occurs when attackers target exposed or unmanaged machine credentials such as API keys, tokens, certificates, or service accounts.
- Escalation follows when those credentials carry broader access than the workload needs, allowing the attacker to operate as a legitimate system identity.
- Impact comes from persistent access to cloud resources, integrations, or data paths that remain trusted because the NHI was never fully governed.
Breaches seen in the wild
- United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.
- Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Non-human identity blind spots are a control failure, not a visibility footnote. The article is right to frame undiscovered NHIs as latent vulnerabilities because the risk appears when machine credentials exist outside documented ownership and review. That turns identity governance into an inventory and attribution problem before it becomes an access problem. Practitioners should treat any unmanaged NHI as governance debt that is already affecting exposure.
Machine identity lifecycle is now the decisive control plane. The article points to rotation, vaulting, least privilege, and masking as the controls that separate governable NHIs from shadow access. That aligns with OWASP-NHI and NIST CSF thinking: lifecycle and permissions matter more than the sheer count of identities. The field should stop describing NHI risk as a scaling issue and start treating it as lifecycle drift across credentials that outlive their business purpose.
Centralised identity governance is the difference between policy and theatre. When NHIs sit in a standalone tool, organisations may know a secret exists without being able to enforce ownership, anomalous-use review, or consistent offboarding. The article’s real insight is that NHI risk becomes systemic when IAM, PAM, and IGA do not share the same enforcement layer. Practitioners should interpret fragmented tooling as a governance gap, not a tooling preference.
Standing machine access is the named concept that best captures this problem. The article shows that many NHIs still carry persistent access assumptions even though they behave like infrastructure dependencies rather than human accounts. That creates an identity blast radius whenever a credential is leaked, reused, or left unrotated. The implication for the field is straightforward: governance models must assume machine access can be inherited, copied, and abused at scale.
NHI security is now an enterprise identity programme issue, not a specialist side task. The article ties cloud technologies, AI agents, and third-party integrations into the same access problem, which means machine identity governance sits across architecture, operations, and assurance. Frameworks such as OWASP-NHI, NIST CSF, and Zero Trust all point to the same conclusion. Practitioners need a cross-programme model, or the blind spots will keep expanding.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Why NHI Security Matters Now
What this signals
Standing machine access is the real blind spot: organisations are no longer struggling to prove that NHIs exist, they are struggling to make those identities behave like governed assets. When the credential can outlive the workload, the first control question shifts from who approved access to who can still revoke it.
The programme implication is that NHI control design now has to join inventory, ownership, rotation, and anomaly detection into one operating model. If those controls live in separate tools, the organisation will keep producing unmanaged access even while reporting that it has a secrets process in place.
For practitioners
- Map every machine identity to an accountable owner Require named ownership for API keys, service accounts, tokens, and certificates, and block any credential that cannot be tied to a business service or team.
- Move secrets into governed vaulting Store machine credentials in a controlled vault, enforce automatic rotation where possible, and remove secrets from code, configuration, and ad hoc sharing paths.
- Enforce least privilege for each NHI Review the permissions attached to every non-human identity and trim access to the minimum required for the workload or integration it supports.
- Detect anomalous access from machine identities Monitor for unusual token use, unexpected source locations, and access patterns that do not match the workload’s normal runtime behaviour.
- Unify PAM, IGA, and NHI telemetry Use one identity control plane so credential issuance, access policy, review, and revocation all happen against the same record of truth.
Key takeaways
- The article shows that the primary risk is not NHI volume alone but unmanaged machine credentials with no clear owner or lifecycle control.
- Its evidence points to a large and growing exposure surface, including an 82 to 1 ratio of NHIs to human users and a high rate of NHI-linked breaches.
- The control answer is governance that treats NHIs as first-class identities, with inventory, vaulting, rotation, least privilege, and monitoring tied together.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Unowned machine identities linger after their purpose changes or ends. |
| NHI-02 — Secret Leakage | The article highlights exposed secrets and unmanaged credentials as the entry point for abuse. | |
| NHI-05 — Overprivileged NHI | The article recommends least privilege because machine identities often carry more access than needed. | |
| Recommendation — Track every NHI to a business owner and revoke credentials when the workload no longer needs them. Scan repositories, logs, and integrations for leaked NHI secrets and remove exposed credentials immediately. Review NHI entitlements and cut each credential down to the minimum permissions required. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing access permissions for machine identities. |
| Recommendation — Apply PR.AA-05 to inventory and constrain every machine credential's access scope. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential rotation and storage are core issues in the article's NHI governance model. |
| Recommendation — Use IA-5 to manage, rotate, and revoke NHI authenticators on an enforced lifecycle. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Exposed machine credentials enable credential access and downstream movement through trusted systems. |
| Recommendation — Map exposed NHI credentials to TA0006 and TA0008 and prioritise detection around abuse paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article is about managing non-human accounts as governed assets, not unmanaged artefacts. |
| Recommendation — Extend CIS-5 to include service accounts, API keys, tokens, and certificates in your account inventory. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Secret: A secret is the credential that proves a non-human identity is allowed to act. In practice it may be an API key, token, password or certificate. If it is exposed, reused or left valid too long, the resulting compromise can look legitimate to downstream systems.
- Credential Rotation: The practice of regularly replacing secrets and credentials with new values to limit the window of exposure if a credential is compromised. Automated rotation, enforced by policy, is the security-optimal approach.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org