Non-human identity governance: what do teams need to own first?

TL;DR: Arcon argues that service accounts, API keys, OAuth tokens, workload identities and RPA bots now outnumber human users in many environments, yet most lack named owners, rotation schedules or retirement processes. That governance gap leaves machine identities as a persistent breach path, because human-centric IAM and PAM assume a person is present to review, approve and offboard access.

Editorial analysis by NHI Mgmt Group, based on content published by Arcon: “Non-Human Identity Governance: The Identities You Forgot to Own”.

By the numbers:

• CyberArk's 2025 Identity Security Landscape report put the NHI-to-human ratio at 82 to 1.
• For a 5,000-employee enterprise, even a conservative 20:1 ratio means 100,000 non-human identities.

Key questions

Q: What breaks when non-human identity ownership is unclear?

A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation.

Q: How do security teams know if NHI governance is actually working?

A: A working NHI programme shows clear ownership, short-lived credentials, frequent revocation, and low numbers of dormant or shared machine accounts.

Practitioner guidance

• Build a continuous NHI inventory Discover service accounts, API keys, OAuth tokens, workload identities and automation credentials across AD, cloud IAM, Kubernetes, SaaS and CI/CD systems.
• Assign a named owner at creation time Require every non-human identity to have a documented human owner and business justification before the credential is issued or enabled.
• Reduce standing privilege on machine accounts Right-size entitlements continuously and replace persistent access with short-lived, just-in-time credentials wherever the use case allows.

Bottom line: Machine identities create a governance gap because they often exist outside owner-based lifecycle controls, not because they are inherently more complex than human access.

What's in the full article

Arcon's full article covers the operational detail this post intentionally leaves for the source:

• A working definition of non-human identity across service accounts, API keys, OAuth tokens and automation bots
• The four breach patterns that most often turn machine credentials into attacker entry points
• The board-level governance sequence for inventory, ownership, constraint and certification
• How the vendor frames the relationship between secrets vaulting, workload IAM and lifecycle accountability

👉 Read Arcon's analysis of non-human identity governance and machine ownership →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →