Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Non-human identities now outnumber human users 17 to 1 and 0.01% of NHIs control 80% of cloud resources, underscoring how quickly shadow access can concentrate operational risk, according to Veza’s 2026 State of Identity and Access Report. The governance problem is no longer inventory alone, but lifecycle control over ownership, privilege, and rotation.
NHIMG editorial — based on content published by Veza: Non-Human Identities now outnumber human users and best practices for securing the NHI lifecycle
By the numbers:
- Non-human identities now outnumber human users by a factor of 17 to 1, according to the Veza 2026 State of Identity and Access Report.
- A mere 0.01% of NHIs control 80% of cloud resources across the enterprise.
Questions worth separating out
Q: How should security teams implement NHI lifecycle management?
A: Start with discovery, then assign every service account, API key, token, and certificate to an owner with a defined approval and revocation path.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: What breaks when NHI ownership is missing?
A: When NHI ownership is missing, access reviews lose context, incident response slows, and stale identities persist longer than they should.
Practitioner guidance
- Implement continuous NHI discovery Scan repositories, CI/CD pipelines, cloud environments, and vaults to build a real-time inventory of every secret, token, certificate, and service account.
- Replace permanent keys with short-lived credentials Prioritise workload identity federation and ephemeral tokens for applications that currently rely on forever API keys.
- Automate rotation and offboarding triggers Tie key rotation to a 30 to 90 day schedule only where ephemeral access is not yet possible, and delete NHI credentials immediately when a workload is retired.
What's in the full article
Veza's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for building a single source of truth for NHIs across code, CI/CD, and cloud environments.
- Practical examples of how to move from hard-coded keys to short-lived credentials and workload identity federation.
- Specific automation patterns for lifecycle rotation, deletion, and ownership assignment in active environments.
- Behavioural monitoring approaches for identifying anomalous service account activity before it becomes a breach.
👉 Read Veza's analysis of NHI lifecycle best practices and shadow identity risk →
NHI lifecycle security: what changes when identities outnumber users?
Explore further
25/08/2026 6:11 pm
NHI lifecycle security fails when identity is treated as an object, not a governed subject. The article is correct that discovery, ownership, privilege, rotation, and offboarding have to be managed as a continuous chain. Once a service account is allowed to persist without lifecycle ownership, the programme has already accepted unmanaged access as normal. Practitioners should treat that as a governance failure, not a tooling gap.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- Only 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
A question worth separating out:
Q: What is the difference between short-lived credentials and permanent API keys for NHI security?
A: Short-lived credentials limit the window in which access can be abused, while permanent API keys remain valid until someone manually finds and revokes them. In practice, ephemeral access reduces blast radius and makes compromise less durable. Permanent keys create a standing trust assumption that is difficult to defend at scale.
👉 Read our full editorial: NHI lifecycle security depends on visibility, rotation, and ownership
