Topic starter
12/05/2026 4:33 pm
TL;DR: A 44% year-over-year rise in NHI sprawl, 43% of exposed secrets outside code, and 5.5% of AWS machine identities holding administrator privileges were found in Entro Security’s H1 2025 analysis of more than 27 million non-human identities. The central problem is no longer discovery alone, but governing ownership, privilege, and exposure before shadow access becomes normal.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “What 27 Million NHIs Taught Us About Identity Sprawl, Secret Exposure, and Shadow Access”.
By the numbers:
- Entro Security reported a 44% year-over-year increase in NHI sprawl across enterprise environments.
- Entro Security found that 43% of all exposed secrets live outside code.
- Entro Security reported that 5.5% of AWS machine identities hold administrator privileges.
Key questions
Q: What breaks when NHI ownership is missing?
A: When NHI ownership is missing, access reviews lose context, incident response slows, and stale identities persist longer than they should.
Q: Why do exposed NHI secrets create more risk outside code than in code?
A: Because operational tools are where teams paste, log, forward, and share credentials during normal work.
Q: How do overprivileged machine identities increase cloud blast radius?
A: They turn a single credential into broad administrative reach.
Practitioner guidance
- Bind each NHI to an owner and expiry condition Require a named owner, purpose, and removal trigger for every new service account, token, or workload identity before it is allowed into production.
- Expand secret discovery beyond source control Add CI/CD logs, chat platforms, ticketing systems, and project tools to secret scanning and alerting so exposed credentials are found where they are actually shared.
- Review AWS machine identities for admin scope Prioritise entitlements that grant administrator access or broad operational reach, then reduce them to the smallest permission set that still supports the workload.
Bottom line: The article shows that NHI growth, secret leakage, and overprivilege are happening together, which makes lifecycle governance a current control issue rather than a future programme goal.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/05/2026 4:33 pm
NHI sprawl is now a governance failure, not an inventory problem. The article’s core signal is that machine identity growth has outpaced the ability to assign ownership, purpose, and expiry. When NHIs multiply faster than lifecycle controls, governance becomes reactive and fragmented. The practitioner conclusion is that every new identity must carry an owner and a revocation path from day one.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What do security teams get wrong about least privilege in SaaS and cloud environments?
A: Teams often treat least privilege as a role design exercise when the real problem is entitlement drift across multiple identities. A user may look compliant in one platform and over-permissioned in another. Effective least privilege requires cross-platform recertification, not isolated clean-up.
👉 Read our full editorial: Identity sprawl and secret exposure are widening across enterprise NHIs