Notifications
Clear all
Topic starter
23/06/2026 7:31 pm
TL;DR: Non-human identities outnumber human identities by over 92:1 and are attacked far more often, according to Unosecur, so IAM teams need stronger visibility, lifecycle control, and monitoring across cloud and on-premises environments. The real issue is not just credential sprawl but governance that still assumes machine access behaves like human access.
NHIMG editorial — based on content published by Unosecur: Securing non-human identities: Part 3 - strategies to avert and mitigate NHI security risks
By the numbers:
- Non-human identities outnumber human identities in modern enterprises by over 92:1.
- The risk of NHIs being attacked outweighs that on human identities by as much as 17 to 1.
Questions worth separating out
Q: How should security teams govern non-human identities across cloud and on-premises environments?
A: They should use one governance model for both environments, with shared ownership, consistent entitlement rules, and unified logging.
Q: Why do service accounts and API keys create outsized risk when they are overprivileged?
A: Because a single credential can unlock more systems than the workload actually needs, turning one compromise into broader access.
Q: What breaks when machine credentials are not rotated or decommissioned on time?
A: Old credentials remain valid after the business reason for them has ended, which gives attackers more time to find and reuse them.
Practitioner guidance
- Inventory every machine identity Build a single register of service accounts, API keys, tokens, certificates, bots, and workload credentials across cloud, on-premises, and third-party integrations so ownership and purpose are visible.
- Reduce every entitlement to task scope Re-map broad machine permissions to the smallest access set needed for each application, API, or pipeline stage, and remove inherited roles that were added for convenience.
- Automate de-provisioning and rotation Tie credential creation to expiry, offboarding, and rotation workflows so stale secrets are removed when a workload is retired or an integration changes.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- A step-by-step breakdown of IAM and PAM controls for service accounts, API keys, tokens, and certificates.
- Specific examples of lifecycle automation for provisioning, de-provisioning, and credential rotation in hybrid environments.
- Practical monitoring and incident-response patterns for detecting abnormal NHI activity before it spreads.
- Case examples showing how organisations improved posture after a compromise, including recovery steps and control changes.
👉 Read Unosecur's guide to securing non-human identities and reducing NHI risk →
NHI security risks and controls: what teams need to fix now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 3:34 am
Machine identity governance is now an IAM problem, not a niche security problem. The article is right to treat NHIs as the largest part of the identity surface, because service accounts, keys, and tokens now mediate core business processes. Once that population becomes larger than the human estate, weak lifecycle discipline and inconsistent policy enforcement stop being edge cases and become programme-level exposure. The implication is that identity teams must govern machine principals as first-class identities.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means most teams still cannot see the identities they are expected to govern.
A question worth separating out:
Q: How do organisations know whether NHI governance is actually working?
A: They should look for proof that every non-human identity has an owner, a purpose, a scope limit, a rotation rule, and a defined offboarding path. If any of those are missing, governance is incomplete even if tools are in place. Strong programmes show fewer dormant credentials, fewer broad roles, and faster revocation when incidents occur.
👉 Read our full editorial: Securing non-human identities: the governance gaps teams must close
