Topic starter
10/07/2026 9:19 pm
TL;DR: Non-human identities are expanding faster than governance can track, with 82 to 1 NHI-to-human ratios in early 2025, 77% of organisations treating undiscovered machine identities as latent vulnerabilities, and 50% reporting NHI-linked breaches in the past twelve months, according to Soffid research. The real failure is assuming machine access can be governed like human access when ownership, rotation, and monitoring are still missing.
Editorial analysis by NHI Mgmt Group, based on content published by Soffid: “Non-Human Identities (NHI): The Hidden Risk in Modern Cybersecurity”.
By the numbers:
- Non-human identities outnumbered human users by a ratio of 82 to 1 in the first half of 2025, according to CyberArk.
- 77% of organisations acknowledge that every undiscovered machine identity is a latent vulnerability, according to CyberArk.
- 50% of organisations have suffered breaches linked to non-human identities in the past twelve months, according to NHIMG.
Key questions
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access.
Q: Why do undiscovered machine identities create so much risk?
A: Undiscovered machine identities create risk because they can remain active outside normal review cycles while still carrying access to production systems.
Q: How can security teams reduce the attack surface created by NHIs?
A: Security teams reduce NHI attack surface by combining inventory, vaulting, rotation, least privilege, and continuous monitoring in one governance model.
Practitioner guidance
- Map every machine identity to an accountable owner Require named ownership for API keys, service accounts, tokens, and certificates, and block any credential that cannot be tied to a business service or team.
- Move secrets into governed vaulting Store machine credentials in a controlled vault, enforce automatic rotation where possible, and remove secrets from code, configuration, and ad hoc sharing paths.
- Enforce least privilege for each NHI Review the permissions attached to every non-human identity and trim access to the minimum required for the workload or integration it supports.
Bottom line: The article shows that the primary risk is not NHI volume alone but unmanaged machine credentials with no clear owner or lifecycle control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:41 pm
Non-human identity blind spots are a control failure, not a visibility footnote. The article is right to frame undiscovered NHIs as latent vulnerabilities because the risk appears when machine credentials exist outside documented ownership and review. That turns identity governance into an inventory and attribution problem before it becomes an access problem. Practitioners should treat any unmanaged NHI as governance debt that is already affecting exposure.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between human identity governance and NHI governance?
A: Human identity governance focuses on onboarding, role changes, and access reviews for people. NHI governance must also manage machine-to-machine trust, secret rotation, token reuse, and identity retirement across systems. The practical difference is that machine identities need automated lifecycle controls, not just periodic attestations.
👉 Read our full editorial: Non-human identity blind spots are widening enterprise attack surface