Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Authentication-first platforms can secure the front door while leaving non-human identities unmanaged, according to SailPoint research, which cites a 45:1 NHI-to-human ratio, 97% excessive privilege rate, and 41% of identity-related breaches tied to NHI weakness. The core issue is not login control but downstream entitlement governance, accountability, and lifecycle enforcement across machine actors.
NHIMG editorial — based on content published by SailPoint: The invisible workforce: why authentication-first platforms can leave non-human identities ungoverned
By the numbers:
- Non-human identities now vastly outnumber human identities by a ratio of 45 to 1.
- 97% of non-human identities hold excessive privileges.
- NHI security weakness was the root cause of 41% of successful identity-related breaches.
Questions worth separating out
Q: What breaks when non-human identities are governed like human users?
A: Lifecycle triggers, ownership, and review processes stop working because machine identities do not generate joiner, mover, or leaver events.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do security teams know if NHI governance is actually working?
A: A working NHI programme shows clear ownership, short-lived credentials, frequent revocation, and low numbers of dormant or shared machine accounts.
Practitioner guidance
- Build an authoritative NHI inventory Catalogue service accounts, API keys, bots, RPA scripts, and AI agents, then attach owner, system, purpose, and lifecycle state metadata to each identity.
- Separate authentication coverage from entitlement review Audit where your current platform can authenticate access but cannot report or govern transaction-level permissions, role inheritance, or application-specific entitlements.
- Implement a human-owned steel thread for every NHI Require a named business owner and technical steward for each non-human identity so rotation, review, and revocation have an accountable decision path.
What's in the full article
SailPoint's full blog post covers the operational detail this post intentionally leaves for the source:
- How the platform boundary shows up in directory services, SSO, and MFA workflows for human users
- Examples of entitlement-level coverage limits and connector gaps across hybrid environments
- The article’s explanation of closed-loop remediation logic for non-human identities
- The vendor’s framing of a unified control plane for certification and remediation
👉 Read SailPoint's analysis of why authentication-first platforms can leave NHIs ungoverned →
Authentication-first identity platforms and the NHI governance gap?
Explore further
02/09/2026 1:30 pm
Authentication-first coverage is not identity governance. Platforms designed around login entry points can authenticate a subject while leaving its actual authority ungoverned. That difference matters because NHI risk lives in entitlements, lifecycle state, and ownership, not in whether a credential can open a session. Practitioners should stop treating directory coverage as proof of control.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between authenticating a user and governing a cloud identity?
A: Authentication confirms that an identity presented acceptable proof at a moment in time. Governance controls what that identity can do afterward, how long it can do it, and how quickly access is removed when the business purpose ends. Cloud incidents increasingly occur in the gap between those two controls.
👉 Read our full editorial: Authentication-first platforms leave NHI governance gaps
