TL;DR: NHIs now outnumber human users by 45:1 to 100:1 in cloud environments, while 95% of cloud identities are over-privileged and 80% of breaches involve compromised identities, according to Andromeda Security. The control problem is no longer secret rotation alone. Blast-radius reduction, ownership, and lifecycle governance are now the decisive variables in NHI security.
At a glance
What this is: This is a risk brief arguing that non-human identity sprawl is outpacing cloud governance because NHIs are over-privileged, weakly owned, and often unmanaged across their lifecycle.
Why it matters: IAM, PAM, and cloud security teams need to treat NHI inventory, entitlement scope, and offboarding as core governance controls, not optional hygiene.
By the numbers:
- NHIs outnumber human users anywhere from 45:1 to 100:1 in cloud environments.
- 95% of cloud identities are over-privileged.
Context
Non-human identity governance now sits at the centre of cloud security because service accounts, tokens, certificates, API keys, and workload identities often exist outside the review cycles built for people. The article argues that this leaves a large identity surface with no equivalent to human MFA, no authoritative source of record, and no consistent lifecycle ownership.
The result is not just credential sprawl. It is an access model where entitlement scope, orphaned ownership, and delayed offboarding determine how far a compromised identity can move once an attacker gets in.
Key questions
Q: What breaks when non-human identities have more access than they need?
A: When non-human identities carry excess access, a single compromise can move from a local incident to broad cloud control. Over-privileged service accounts, tokens, and AI agents can reach storage, compute, and IAM functions that were never necessary for their job. The result is larger blast radius, faster lateral movement, and much harder containment.
Q: How do overprivileged NHIs increase breach impact in cloud environments?
A: They widen the blast radius because attackers can use one compromised credential to move laterally, access adjacent systems, and persist through new accounts or modified configurations. Entro Labs' full analysis covers mitigation patterns and operational examples in more detail.
Q: How should teams decide which NHI controls to fix first?
A: Start with inventory and ownership, then move to privilege reduction and offboarding. If a team cannot name every service account or token owner, it cannot safely decide which credentials are still needed. The first priority is therefore visibility into the identity estate, followed by reducing blast radius on the most exposed identities.
Q: How do organisations know whether NHI governance is working?
A: Governance is working when every machine identity has a known owner, a clear purpose, visible entitlements, and a defined retirement path. If service accounts remain unclassified, secrets are embedded in code, or credentials outlive the workload they support, the programme is still operating with blind spots.
Technical breakdown
Why NHI entitlement scope determines blast radius
An NHI is not only a credential, it is the permissions attached to that credential. If a service account or workload identity is over-privileged, compromise of a single secret can translate into broad access across cloud resources, data, and automation paths. That is why the article treats entitlements as the decisive variable, not just secret hygiene. Blast radius is determined at authorization time, not when the credential is rotated.
Practical implication: map every NHI to its effective permissions and remove standing access that is not required for routine execution.
Why NHI authentication fails without MFA and lifecycle control
NHIs commonly authenticate with API keys, access keys, certificates, and tokens rather than human-style MFA. That makes them fast to use, but also easy to forget, duplicate, and leave active after the business process or developer owner has moved on. In practice, the lack of a human lifecycle analogue means the control surface is inventory, rotation, revocation, and ownership, not user prompts.
Practical implication: treat every machine credential as a governed asset with an owner, a purpose, and an offboarding trigger.
How cloud sprawl creates unmanaged NHI inventory
Cloud adoption, DevOps pipelines, and automation create NHIs dynamically, often before security teams know they exist. Without a central authoritative source, discovery lags creation and governance becomes reactive. The operational problem is therefore not only privilege creep but identity drift, where the estate grows faster than the control plane that is supposed to track it.
Practical implication: build continuous discovery for service accounts, workload identities, and secrets so governance begins with visibility.
Threat narrative
Attacker objective: The attacker wants rapid cloud access through a low-resistance identity so they can move laterally and expand their foothold before defenders can contain it.
- Entry begins when attackers obtain a compromised NHI credential, such as a key, token, certificate, or access key that lacks MFA protection.
- Escalation occurs when the stolen identity has standing privileges that let the attacker reuse the credential across cloud resources and administrative workflows.
- Impact follows as the attacker uses those permissions for lateral movement, breach activity, and broader cloud exposure before the identity is detected or revoked.
Breaches seen in the wild
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Blast-radius governance is now the real NHI control plane: the article makes clear that the central risk is not whether an NHI exists, but how much it can do if compromised. When 95% of cloud identities are over-privileged, the security question becomes how much damage a single credential can cause before it is discovered. Practitioners should treat entitlement scope as the primary reduction lever, because credential rotation alone does not shrink the impact window.
Human-centric lifecycle governance breaks down for NHIs: human identity programmes assume a person can be onboarded, reviewed, and offboarded through established organisational processes. NHIs do not follow that model, because they are often created by developers, vendors, or pipelines and then left behind after the sponsoring relationship ends. The implication is that lifecycle governance must be attached to the identity itself, not inferred from a human owner who may no longer be present.
Dynamic discovery must replace static NHI inventories: the article describes an estate that expands through cloud adoption, DevOps, and automation faster than central oversight can track it. That creates governance lag, where security teams only see the identity after it is already carrying permissions into production. Ephemeral NHI trust debt: the gap between creation and formal ownership is now a structural risk, and practitioners need continuous discovery to close it.
Rotation is necessary but no longer sufficient: the vendor correctly points out that long-lived secrets are risky, but the deeper issue is that secret refresh does not fix over-privilege, orphaned accounts, or absent accountability. A rotated credential with the same standing access still leaves the same attack path intact. Practitioners should reframe NHI security around access scope, ownership, and revocation authority, not around secret turnover alone.
AI adoption is increasing identity pressure across the cloud estate: as generative AI and automation expand, more systems need machine credentials, service accounts, and delegated entitlements to operate. That widens the overlap between cloud governance, workload identity, and identity security operations. The field should expect NHI governance to become a core dependency of cloud control maturity, not a specialist add-on.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 68% of organisations do not know how to fully address NHI risks, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Ephemeral NHI trust debt: the gap between identity creation and formal governance is now a practical risk signal for cloud teams. When service accounts and workload identities appear faster than ownership and review can be assigned, the programme is already behind.
Cloud teams should expect NHI governance to become a board-level cloud resilience topic because the control failure is structural, not isolated. Discovery, entitlement reduction, and lifecycle offboarding now define whether a compromised credential becomes a contained event or a cloud-wide incident.
For practitioners
- Discover every NHI across cloud estates Build a complete inventory of service accounts, workload identities, API keys, certificates, and tokens before trying to optimize privileges or rotation.
- Right-size entitlements continuously Review effective permissions against actual usage and remove unused or excessive access so compromise cannot spread across broad cloud permissions.
- Attach human ownership to every NHI Assign a named sponsor for creation, review, and decommissioning so orphaned identities do not persist after employees, vendors, or processes change.
- Shift risky access to just-in-time elevation Keep standing entitlements low-risk and frequent, then move exceptional access into time-bound elevation rather than permanent grants.
- Automate anomalous activity response Use behavioural monitoring to detect unusual NHI activity and trigger key rotation, entitlement removal, or session termination when the pattern changes.
Key takeaways
- Non-human identity sprawl is not a niche cloud hygiene issue. It is a control problem that widens attack surface whenever service accounts and machine credentials outgrow governance.
- The article ties the risk to concrete exposure signals, including 45:1 to 100:1 NHI density, 95% over-privilege, and 80% of breaches involving compromised identities.
- The most effective response is to govern NHI inventory, ownership, and entitlement scope as a single lifecycle problem rather than treating secret rotation as the main fix.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Over-privilege is the article's central control failure and blast-radius driver. |
| NHI-01 — Improper Offboarding | The article highlights orphaned NHIs left behind after people or processes leave. | |
| NHI-07 — Long-Lived Secrets | The brief warns that NHI secrets are often long-lived and unrotated. | |
| Recommendation — Reduce standing permissions on NHIs and review effective access against actual usage. Tie NHI decommissioning to human and process offboarding so unused identities are revoked. Shorten credential lifetimes and revoke stale secrets before they remain usable in production. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential lifecycle control is necessary for keys, tokens, and certificates used by NHIs. |
| Recommendation — Apply authenticator management to rotate, revoke, and retire machine credentials on schedule. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on entitlement scope as the real determinant of compromise impact. |
| Recommendation — Limit and review NHI authorizations so compromised identities cannot access more than needed. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The risk brief describes stolen credentials enabling lateral movement across cloud resources. |
| Recommendation — Map NHI exposure to credential access and lateral movement techniques in detection and response. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Identity Ownership: Identity ownership is the assignment of a responsible human for each identity's purpose, access, review, and retirement. For non-human identities, ownership must be explicit because the creator is not always the right person to approve ongoing access. Without ownership, review and revocation become inconsistent and slow.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 6, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org