Topic starter
23/06/2026 8:30 pm
TL;DR: Unosecur argues that NHI risk is moving beyond simple credential exposure toward blast-radius control, because static tokens, weak rotation, and inconsistent governance let a single compromise spread across cloud, on-prem, CI/CD, and IoT environments. The governing question is no longer whether NHIs exist, but how quickly their permissions can be contained.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Security Risks of NHIs in Hybrid Environments”.
By the numbers:
- According to Deloitte, almost 30% of organisations have accidentally posted critical tokens or secrets to public platforms at least once.
- EY recently noted that 43% of breaches in legacy environments began with the compromise of a service account.
- The 2024 PwC IoT Security Survey notes that 35% of companies reported an IoT-related intrusion in the past year.
Key questions
Q: What breaks when a machine identity has more access than it needs?
A: Overprivileged machine identities turn a single credential compromise into lateral movement, data access, and configuration change.
Q: Why do long-lived NHI secrets create disproportionate breach risk?
A: Long-lived secrets extend the time an attacker can reuse a stolen credential and make revocation harder after exposure.
Q: How do teams reduce the blast radius of unmanaged service accounts?
A: Teams reduce blast radius by narrowing permissions, removing inactive identities, and preventing credentials from persisting after their business purpose ends.
Practitioner guidance
- Inventory machine identities by business reach Classify every application, service account, API token, container identity, and CI/CD credential by which systems it can actually touch, then prioritise the highest blast-radius identities first.
- Rotate long-lived secrets on a shorter schedule Set enforced rotation for static tokens, API keys, and service-account passwords, and treat any credential that cannot be rotated cleanly as a candidate for replacement.
- Remove permissions that were granted for convenience Review overprivileged NHIs for broad access that is not required for task execution, especially where one credential can reach production systems, data stores, or deployment tools.
Bottom line: The article's core warning is that machine identity risk is now about how far compromise can spread, not just whether a credential exists.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- The article's per-NHI breakdown of A2A identities, service accounts, cloud keys, containers, CI/CD, and IoT devices.
- The source discussion of specific credential weaknesses such as hardcoded tokens, weak rotation, and default passwords.
- The article's own examples of how distributed environments complicate logging, policy consistency, and lifecycle control.
- The practical mitigation discussion that follows after the risk analysis, including governance and monitoring considerations.
👉 Read Unosecur's analysis of how NHI security risk is shifting from exposure to blast radius →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:35 am
Blast radius is now the primary NHI control variable: The article shows that the real problem is no longer whether an NHI can be discovered, but how far it can travel once compromised. Static credentials and broad permissions turn exposure into enterprise spread, which means containment, not just detection, has become the governing design goal. Practitioners should measure every machine identity by reachable impact.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: What should IAM teams do when cloud, DevOps, and GenAI all create NHIs?
A: Treat machine identity governance as a shared programme across IAM, secrets management, and operational security, not as a one-off tool deployment. The right model combines inventory, access intelligence, monitoring, and lifecycle control so new identities are governed before they become exposure paths.
👉 Read our full editorial: NHI security risks are shifting from exposure to blast radius