Topic starter
25/10/2026 11:07 am
TL;DR: Arcon's analysis of machine identities finds many environments now have more non-human credentials than human users, with ratios ranging from 50 to 1 to well over 80 to 1. Without named owners and lifecycle controls, those credentials linger and remain hard to retire.
Editorial analysis by NHI Mgmt Group, based on content published by Arcon: “Non-Human Identity Governance: The Identities You Forgot to Own”.
By the numbers:
- CyberArk's 2025 Identity Security Landscape report put the NHI-to-human ratio at 82 to 1.
- For a 5,000-employee enterprise, even a conservative 20:1 ratio means 100,000 non-human identities.
Key questions
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do security teams know if NHI governance is actually working?
A: A working NHI programme shows clear ownership, short-lived credentials, frequent revocation, and low numbers of dormant or shared machine accounts.
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access.
Practitioner guidance
- Build a continuous NHI inventory Discover service accounts, API keys, OAuth tokens, workload identities and automation credentials across AD, cloud IAM, Kubernetes, SaaS and CI/CD systems.
- Assign a named owner at creation time Require every non-human identity to have a documented human owner and business justification before the credential is issued or enabled.
- Reduce standing privilege on machine accounts Right-size entitlements continuously and replace persistent access with short-lived, just-in-time credentials wherever the use case allows.
Bottom line: Machine identities create a governance gap because they often exist outside owner-based lifecycle controls, not because they are inherently more complex than human access.
Glossary terms: Non-Human Identity (NHI), Machine Identity, Credential Sprawl, Lifecycle Offboarding
What's in the full article
Arcon's full article covers the operational detail this post intentionally leaves for the source:
- A working definition of non-human identity across service accounts, API keys, OAuth tokens and automation bots
- The four breach patterns that most often turn machine credentials into attacker entry points
- The board-level governance sequence for inventory, ownership, constraint and certification
- How the vendor frames the relationship between secrets vaulting, workload IAM and lifecycle accountability
👉 Read Arcon's analysis of non-human identity governance and machine ownership →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 week ago 2 times by NHI Mgmt Group
27/10/2026 7:16 pm
Ownership is the missing control, not inventory alone: machine identities become governable only when a named human is accountable for their existence, scope and retirement. Without ownership, access reviews cannot close anything because no one can attest to business need or revoke access when the purpose ends. The implication is that NHI programmes should be judged by lifecycle accountability, not by the size of the discovered inventory.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise machine identities before human access reviews?
A: They should prioritise both, but machine identities often deserve immediate attention because they are numerous, long-lived, and under-reviewed. If service accounts and keys are unmanaged, human access reviews alone will not close the largest exposure paths.
👉 Read our full editorial: Non-human identity governance starts with ownership, not inventory
This post was modified 1 week ago by NHI Mgmt Group