Topic starter
24/06/2026 5:50 pm
TL;DR: Unosecur finds that hybrid environments multiply non-human identities and make placement, visibility, and privilege control harder to govern, as service accounts, API keys, container identities, and pipeline tokens create hidden access paths across cloud and on-prem systems. The core problem is not just more credentials, but unmanaged credential placement that outpaces discovery and lifecycle control.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Types of NHIs & their placement in hybrid environments”.
By the numbers:
- Mismanaged machine credentials are becoming one of the top causes of unauthorized access in hybrid cloud infrastructures, according to Deloitte’s 2023 Global Security Report cited by Unosecur.
- PwC’s 2023 report found that 60% of organizations experienced at least one incident where leaked or misconfigured A2A credentials were exploited by attackers.
- Overprivileged service accounts account for nearly 40% of lateral movement in on-prem breaches, according to Deloitte’s 2024 Global Cyber Executive Briefing cited by Unosecur.
Key questions
Q: What breaks when non-human identities are not mapped to their actual runtime placement?
A: Discovery becomes incomplete, ownership stays unclear, and security teams cannot reliably apply the right controls to the right credential.
Q: Why do service accounts increase lateral movement risk in enterprise environments?
A: Service accounts often connect multiple systems, so they sit at the center of trust relationships that humans never see directly.
Q: What are the signs that NHI lifecycle governance is failing in hybrid cloud?
A: The clearest signs are stale accounts that remain active after migrations, sync identities that still bridge multiple environments, and service accounts whose permissions no longer match their workload.
Practitioner guidance
- Classify every NHI by placement Map each service account, API key, container identity, and pipeline token to its runtime location, owner, and trust boundary so that governance can follow the credential instead of the platform.
- Split policies for internal and external machine access Apply different controls to external API integrations and internal service accounts because their exposure paths, blast radius, and revocation needs are not the same.
- Remove shared service account usage Replace shared credentials with identity-specific ownership and separate entitlements so a compromise in one workload cannot automatically extend across the environment.
Bottom line: The main governance issue is not that machine identities exist, but that hybrid placement fragments ownership, visibility, and control.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- The article’s credential-by-credential walk-through of API keys, service accounts, container identities, pipeline tokens, and IoT device IDs
- The specific cloud, on-premises, DevOps, and edge examples used to show where each NHI typically resides
- The article’s own implementation advice on least privilege, RBAC, short-lived tokens, and centralised secrets management
- The real-world examples of exposed AWS keys and overprivileged service accounts that illustrate the failure modes
👉 Read Unosecur's analysis of securing non-human identities in hybrid environments →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:39 am
Hybrid NHI placement is now a governance problem, not an inventory problem. The article shows that organisations already know NHIs exist, but still struggle to place them consistently across cloud, on-premises, container, and edge environments. That means the failure is structural: ownership, scope, and storage are fragmented by design, so visibility alone will not fix the exposure. Practitioners need to treat placement as a governance control, not a discovery exercise.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern short-lived tokens without assuming they are low risk?
A: Short-lived tokens should be governed as issued trust, not as harmless temporary access. Teams need controls for who can mint them, what scope they carry, where they are stored, and how they are revoked when the workload changes. Expiry reduces exposure time, but it does not replace ownership or lifecycle management.
👉 Read our full editorial: Securing non-human identities in hybrid environments