Notifications
Clear all
Topic starter
02/08/2026 12:05 pm
TL;DR: Identity has become the primary security perimeter, and Torq’s guide argues that IAM maturity now depends on extending governance from humans to service accounts, API keys, and cloud credentials, with 88.5% of organisations saying non-human IAM lags human IAM in Aembit’s 2024 report. The structural problem is that access review cycles, standing privilege assumptions, and fragmented tooling were built for slower human-paced identities, not high-volume machine identities.
NHIMG editorial — based on content published by torq: IAM best practices and the three-phase identity maturity model
Questions worth separating out
Q: How should security teams govern non-human identities in cloud environments?
A: Start with complete discovery, because you cannot govern what you cannot see.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: What breaks when non-human identities are not monitored and reviewed?
A: Detection, accountability, and incident response all weaken at the same time.
Practitioner guidance
- Inventory all non-human identities across cloud and SaaS Build a complete inventory of service accounts, API keys, tokens, certificates, and automation credentials, then assign each one an accountable owner and a business purpose.
- Eliminate standing privilege for machine credentials Replace persistent elevated access with task-scoped access where possible, and require automatic expiry for temporary credentials.
- Move secrets out of code and shared channels Force all credentials into a managed secrets vault and prohibit storage in source files, chat, email, or shared drives.
What's in the full article
Torq's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step IAM maturity sequencing across foundational, dynamic, and governance phases
- Specific examples of IAM controls for MFA, SSO, JIT access, and access certification
- Operational guidance on automating certificate and attestation workflows across environments
- Case-management detail for identity alerts and compliance reporting in a SOC workflow
👉 Read Torq's guide to IAM best practices and non-human identity governance →
Non-human identity governance in IAM: where the maturity gap shows?
Explore further
02/08/2026 1:10 pm
Non-human identity governance is now the real maturity test for IAM. Human IAM controls can look mature while service accounts, API keys, and workload credentials remain poorly governed. That gap matters because the article’s own three-phase model only becomes defensible when machine identities are brought into the same lifecycle discipline. The practitioner conclusion is simple: if NHI is outside your governance model, your IAM maturity score is overstated.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: Who is accountable when a machine credential is abused?
A: Accountability should sit with the team that owns the workload, the identity lifecycle, and the connected business process, not with security alone. In regulated environments, that usually means engineering, platform, and IAM teams share responsibility for discovery, rotation, and offboarding while compliance verifies that the process is repeatable.
👉 Read our full editorial: IAM maturity now depends on governing non-human identities
