Non-human identity governance starts with ownership, not inventory

At a glance

What this is: This is a governance analysis of non-human identities and the central finding is that most machine credentials are still unmanaged, orphaned or over-privileged.

Why it matters: It matters because IAM, PAM and IGA programmes that were built around human lifecycle controls miss the ownership, rotation and offboarding needs of service accounts, tokens and workloads.

By the numbers:

• Published estimates of the NHI-to-human ratio vary from roughly 50 to 1 to well over 80 to 1 in recent vendor research.
• CyberArk's 2025 Identity Security Landscape report put the NHI-to-human ratio at 82 to 1.
• For a 5,000-employee enterprise, even a conservative 20:1 ratio means 100,000 non-human identities.
• Stolen credentials appeared in almost one-third of breaches over the past 10 years, according to Verizon's 2024 Data Breach Investigations Report cited by Arcon.

👉 Read Arcon's analysis of non-human identity governance and machine ownership

Context

Non-human identity governance starts with a simple gap: most enterprises still treat machine access as configuration, not as an identity lifecycle that must be owned, reviewed and retired. In practice, service accounts, API keys, OAuth tokens and workload identities often exist outside the human controls that would normally prevent privilege from becoming permanent.

The article's core argument is that this gap is not just an inventory problem. It is a governance failure that shows up when the organisation assumes machines are trusted by default, even though the same credentials can persist long after the people, applications or pipelines that created them have changed.

Agentic AI adds another layer, but the base problem remains the same for non-human identities: if no one owns the credential, no one is accountable for its scope, rotation or retirement. That is why NHI lifecycle governance matters before any attempt to scale automation or AI-driven access.

Key questions

Q: What breaks when non-human identity ownership is unclear?

A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access. That creates orphaned identities, stale credentials, and broad permissions that persist because the organisation cannot prove what depends on them. The result is a growing attack surface with no accountable decision-maker.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.

Q: How do security teams know if NHI governance is actually working?

A: A working NHI programme shows clear ownership, short-lived credentials, frequent revocation, and low numbers of dormant or shared machine accounts. Teams should be able to trace every high-risk nonhuman identity to a business purpose, a runtime policy, and a retirement path. If they cannot, governance is fragmented.

Q: Should organisations prioritise machine identities before human access reviews?

A: They should prioritise both, but machine identities often deserve immediate attention because they are numerous, long-lived, and under-reviewed. If service accounts and keys are unmanaged, human access reviews alone will not close the largest exposure paths.

Technical breakdown

What counts as a non-human identity in enterprise systems?

A non-human identity is any digital identity that authenticates, requests access or executes actions without a human at the keyboard. That includes service accounts, API keys, OAuth tokens, workload identities, CI/CD credentials and automation bots. The technical issue is not just that these identities exist, but that they span directories, cloud platforms, pipelines and application stacks, which makes ownership and revocation harder than in human IAM. In governance terms, each of these identities has a lifecycle, an access scope and a recovery path when trust is lost. Practical implication: build one inventory model that covers all machine identity types before trying to manage them separately. See the NHI Lifecycle Management Guide. See the NHI Lifecycle Management Guide.

Practical implication: define one inventory model for all machine identity types before trying to govern them separately.

Why human-centric IAM and PAM controls fail for machines

Human identity controls assume a person can satisfy MFA, answer for usage, and leave through an HR offboarding process. Machines do none of those things. They usually authenticate with static secrets, certificates or short-lived tokens, and they often continue to exist after the engineer, project or application that created them has moved on. That is why human review cadences do not naturally catch orphaned service accounts or over-privileged workload identities. The control failure is structural, not operational. Practical implication: separate machine credential governance from human access governance and design for lifecycle ownership at creation time. See the Ultimate Guide to NHIs.

Practical implication: separate machine credential governance from human access governance and assign lifecycle ownership at creation time.

How credential sprawl turns NHI governance into a breach path

Credential sprawl is the distribution of machine secrets across repositories, container images, pipelines, chat systems and laptops. Once a secret leaves the intended vault boundary, the effective perimeter becomes every place that secret was copied or reused. Attackers do not need to defeat the whole identity system when one exposed API key or pipeline token can grant direct access to cloud resources or downstream services. This is why secrets handling is inseparable from governance: a credential with no owner and no retirement process is an open-ended access path. Practical implication: treat every exposed machine secret as both an inventory issue and an active access issue. See the NHI Authentication Guide. See the NHI Authentication Guide.

Practical implication: treat every exposed machine secret as both an inventory issue and an active access issue.

Threat narrative

Attacker objective: The attacker wants durable, low-friction access through machine credentials that bypass human authentication and survive normal user offboarding.

1. Entry occurs when attackers obtain a leaked API key, OAuth token or pipeline credential from a repository, build system or other exposed location.
2. Credential access follows when the stolen machine secret is used to authenticate directly to cloud services or application back ends without human MFA.
3. Escalation happens when the compromised identity already carries broad permissions, allowing the attacker to enumerate resources and expand reach.
4. Impact is achieved when the attacker reaches production data, alters downstream artifacts or maintains a persistent foothold through an orphaned service account.

Breaches seen in the wild

• Kubeflow cryptomining attacks 2020: Exposed Kubeflow dashboards and a notebook's mounted Kubernetes service account let attackers run cryptominers on tens of ML clusters.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ownership is the missing control, not inventory alone: machine identities become governable only when a named human is accountable for their existence, scope and retirement. Without ownership, access reviews cannot close anything because no one can attest to business need or revoke access when the purpose ends. The implication is that NHI programmes should be judged by lifecycle accountability, not by the size of the discovered inventory.

Human IAM assumptions collapse when the subject is a machine: the familiar model of MFA, manager attestation and leaver workflows was designed for identities that have a person behind them. Service accounts and workload identities do not leave through HR, and they do not present interactive authentication factors. That assumption failure means the programme has to move governance upstream to issuance, rotation and offboarding rather than relying on downstream review.

Credential sprawl creates identity blast radius: once an API key or token is copied into code, logs, pipelines or developer laptops, the control boundary is no longer the vault. Every extra copy increases the number of places an attacker can recover a valid credential, which is why secrets leakage and ownership gaps compound each other. Practitioners should treat secret distribution as a blast-radius problem, not a storage problem.

The four-step governance model is a control sequence, not a tool checklist: inventory, own, constrain, certify and monitor are sequential governance actions that only work when each identity is continuously tied to a lifecycle owner. The post's value is that it frames NHI governance as a business control model for access accountability, not a vault deployment exercise. That is the right operating assumption for identity teams, platform teams and boards alike.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity blast radius: machine identity risk is increasingly defined by how far a credential can travel, not just by whether it was exposed. A secret copied into source control, a build pipeline or a shared chat thread expands the number of systems that now trust the same credential, which is why governance has to follow the credential across its copies.

The practical shift for programmes is to move NHI control from periodic discovery to lifecycle enforcement. If access is issued faster than it is reviewed, and if revocation depends on human memory rather than ownership, the environment will keep producing orphaned credentials that look legitimate until they are abused.

This is where non-human identity governance intersects with workload identity and secrets management: discovery alone does not reduce risk unless issuance, rotation and retirement are tied to a control owner and a defined business purpose.

For practitioners

• Build a continuous NHI inventory Discover service accounts, API keys, OAuth tokens, workload identities and automation credentials across AD, cloud IAM, Kubernetes, SaaS and CI/CD systems.
• Assign a named owner at creation time Require every non-human identity to have a documented human owner and business justification before the credential is issued or enabled.
• Reduce standing privilege on machine accounts Right-size entitlements continuously and replace persistent access with short-lived, just-in-time credentials wherever the use case allows.
• Rotate and revoke secrets on a fixed cadence Vault static secrets, set rotation schedules, and revoke credentials immediately when ownership lapses, an application retires, or a pipeline changes.
• Certify non-human identities alongside human access Bring machine identities into recurring access review and monitoring workflows so orphaned accounts and unusual activity surface before they become persistence channels.

Key takeaways

• Machine identities create a governance gap because they often exist outside owner-based lifecycle controls, not because they are inherently more complex than human access.
• The article cites a persistent scale problem, including estimates ranging from 50 to 1 to well over 80 to 1, which means manual oversight will not keep pace.
• The decisive control is ownership tied to rotation and retirement, because discovery without lifecycle enforcement leaves orphaned credentials in place.

Related NHI Mgmt Group resources: Ultimate Guide to NHIs · NHI Lifecycle Management Guide · Guide to NHI Rotation Challenges · NHI Authentication Guide

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Credential Sprawl: Credential sprawl is the uncontrolled accumulation of machine secrets, keys, and tokens across systems, teams, and environments. It usually starts with a single use case and ends with overlapping permissions, unclear ownership, and a larger attack surface than the organisation expected.
• Lifecycle Offboarding: Lifecycle offboarding is the process of removing an identity when it is no longer needed or no longer under the original owner’s control. In NHI programmes, it applies to service accounts and integrations as well as people, and it is essential for preventing stale access from surviving ownership changes.

What's in the full article

Arcon's full article covers the operational detail this post intentionally leaves for the source:

• A working definition of non-human identity across service accounts, API keys, OAuth tokens and automation bots
• The four breach patterns that most often turn machine credentials into attacker entry points
• The board-level governance sequence for inventory, ownership, constraint and certification
• How the vendor frames the relationship between secrets vaulting, workload IAM and lifecycle accountability

👉 The full Arcon article expands on the four-step governance starting point and the breach patterns behind it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.