SailPoint acquires Entro: NHI governance implications for practitioners

At a glance

What this is: SailPoint’s acquisition of Entro is a market move that ties NHI discovery, secret visibility, and agent governance more directly to identity governance workflows.

Why it matters: IAM and NHI teams need to reassess how far governance can extend from inventory into ownership, remediation, and runtime control for machine identities and AI agents.

By the numbers:

• Entro discovers over 1,200 types of NHIs across 70+ critical cloud and developer infrastructure sources.
• Entro scans entire ecosystems across 70+ critical cloud and developer infrastructure sources.

Context

SailPoint’s acquisition of Entro is about extending identity governance into the parts of the environment where non-human identities tend to hide: code, vaults, containers, collaboration tools, and AI agent workflows. The primary issue is not whether organisations know NHI risk exists, but whether they can govern discovery, ownership, and remediation fast enough to matter.

For practitioners, the significance is that NHI management is moving from a point-in-time inventory exercise toward a broader operating model that includes human ownership, lifecycle action, and real-time response. That shift matters because access review and revocation programmes fail when the identity surface is larger than the governance process around it.

Key questions

Q: What is the main governance failure when machine identities spread across code, vaults, and collaboration tools?

A: The failure is assuming a central vault or periodic review can cover the whole estate. In practice, secrets and machine identities appear in many control planes, so incomplete discovery leaves orphaned access, missing owners, and stale privilege outside the scope of governance. The first problem is inventory coverage, not policy design.

Q: Why does ownership matter so much for NHI governance and AI agents?

A: Ownership turns an exposed identity into an accountable governance object. Without it, teams can identify a token or agent but cannot reliably approve remediation, rotate credentials, or assign offboarding responsibility. Ownership is what connects discovery to action, especially when the identity is a machine rather than a person.

Q: Why do periodic access reviews fail for high-churn machine identities?

A: Because review cycles assume identity state stays stable long enough to be observed and certified. High-churn machine identities can be created, reused, or over-privileged between review windows, which leaves governance blind spots. Continuous detection and exception-based review are more effective when entitlement changes happen faster than audit cadence.

Q: How should teams govern sanctioned AI agents and shadow AI differently?

A: Sanctioned agents can be governed through approved ownership, policy, and runtime controls, while shadow AI requires discovery first because it may not appear in standard inventories. The practical difference is that one needs enforcement and the other needs exposure reduction before governance can begin.

How it works in practice

How NHI discovery works across code, vaults, and collaboration tools

NHI discovery is the process of identifying machine credentials, service identities, and agent-related artefacts across the systems where they are created and used. In this article, the emphasis is on scanning code repositories, vaults, registries, configuration files, and collaboration platforms to locate keys, tokens, certificates, and agent traces. That matters because the governance problem starts before access is granted. If the inventory is incomplete, ownership and rotation workflows cannot reliably act on the full estate. The technical shift is from isolated secret checks to environment-wide discovery tied to identity context.

Practical implication: build discovery coverage across development, collaboration, and runtime surfaces, not just central secret stores.

Why human ownership matters for machine identities and AI agents

A discovered credential or agent is still only partially governed until it is linked back to a responsible owner. The article highlights lineage mapping, where NHIs and agent identities are tied to human accountability so access reviews and remediation decisions have context. This is important because a token without ownership tends to become orphaned privilege. For AI agents, the issue is sharper: intent, scope, and responsibility can shift faster than traditional joiner-mover-leaver processes can track. Governance therefore depends on identity relationships, not just identity objects.

Practical implication: require every NHI and agent to resolve to an owner, a business purpose, and an offboarding path.

What runtime remediation changes for NHI control

Runtime remediation moves NHI control from periodic review to continuous enforcement. The article describes behaviour baselines, anomaly detection, revocation triggers, and interception of unauthorized tool calls or prompts. Mechanically, that means governance is no longer limited to static entitlements and rotation schedules. It becomes a control loop that can respond when machine behaviour drifts, privileges are excessive, or secrets leak into operational paths. For identity teams, this is where the boundary between visibility and enforcement becomes operationally important.

Practical implication: pair discovery with automated revocation and policy enforcement so exposure can be contained while the identity is still active.

NHI Mgmt Group analysis

NHI governance is shifting from inventory management to control-plane design: Discovery is no longer the hard part by itself. The harder question is whether the governance model can bind ownership, lifecycle action, and runtime enforcement to every machine identity and agent that matters. That is where most programmes still thin out. The practitioner conclusion is that inventory only has value when it feeds an enforceable control plane.

Identity lineage is now a core control, not an administrative nicety: Tying NHIs and agents back to a human owner solves more than reporting gaps. It determines whether access reviews, revocation decisions, and exception handling can be executed at all. Without lineage, the organisation can find the secret but not the accountable party. The practical conclusion is that accountability must be built into the identity record, not inferred later.

Runtime enforcement is becoming the decisive layer for machine identity governance: Static reviews cannot keep up when secrets, tool calls, and agent actions move faster than recertification cycles. Behavioural baselines and action-level policy enforcement change the control surface from periodic approval to continuous containment. The practitioner conclusion is that identity governance must now assume live exposure, not just stored privilege.

Ephemeral credential trust debt: This deal underscores a governance debt that accumulates when organisations treat machine credentials as discoverable assets but not as continuously governed obligations. The article’s own premise is that secrets, tokens, and certificates are spreading faster than conventional review cycles can absorb them. The practical conclusion is that NHI governance has to be designed for the speed of exposure, not the cadence of audit.

Agent governance and NHI governance are converging: The article shows that AI agents are not a separate problem class from machine identity. They inherit the same issues of discovery, ownership, privilege, and revocation, while adding tool-use and runtime decision pressure. The practitioner conclusion is that teams should govern agents and NHIs through one lifecycle lens, not split them into disconnected programmes.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Ultimate Guide to NHIs

What this signals

Ephemeral credential trust debt: Governance programmes that stop at discovery accumulate risk every time a secret, token, or certificate is found without an owner or an offboarding path. The next control question is whether revocation and runtime policy can follow discovery quickly enough to reduce exposure before the identity is reused.

Machine identities and AI agents should now be handled as a single governance surface wherever they share the same credentials, ownership model, and runtime privileges. Splitting them into separate operational queues creates blind spots between inventory, certification, and enforcement.

The control shift is from asking whether the organisation can find NHIs to asking whether it can intervene while those NHIs are still active. That is the difference between governance as reporting and governance as containment.

For practitioners

• Map the full NHI estate beyond secret vaults Extend discovery into code repositories, collaboration tools, container registries, configuration files, and SaaS audit logs so hidden machine identities are not missed.
• Bind every NHI to a human owner Require each token, key, certificate, and agent identity to resolve to a named owner, business purpose, and offboarding path before it is accepted into governance workflows.
• Move from periodic review to runtime control Add behavioural baselines, anomaly detection, and automated revocation so excessive privilege or tool misuse can be contained while the identity is still active.
• Separate sanctioned agents from unmanaged shadow AI Inventory agent binaries, connected SaaS accounts, and hard-coded credentials so sanctioned automation does not mask unmanaged agent activity.

Key takeaways

• The article’s core issue is not NHI visibility alone but whether discovery can lead to ownership, revocation, and runtime enforcement across the full machine identity surface.
• Entro is described as discovering more than 1,200 NHI types across 70+ cloud and developer infrastructure sources, which shows how broad the hidden identity problem has become.
• Practitioners should treat NHI governance as a live control problem, not a periodic audit problem, because machine identities and AI agents now move faster than traditional review cycles.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Identity Lineage: Identity lineage is the traceable relationship between a human owner and the non-human identities that person creates, authorises, or depends on. It allows security teams to connect service accounts, API keys, tokens, and AI agents back to accountable ownership for review, audit, and retirement decisions.
• Dependency Remediation: Dependency remediation is the process of identifying, testing, and applying fixes for insecure or outdated packages in a software project. In practice, it includes version updates, validation checks, and comparison of code changes so the team can reduce risk without breaking the build or introducing new defects.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.