Topic starter
11/06/2026 11:58 pm
TL;DR: NHIs are often over-privileged, poorly visible, and managed with weaker controls than human identities, and Cerbos cites examples spanning service workloads, OAuth apps, and AI agents alongside CyberArk findings that 50% of organisations saw machine-identity-linked breaches in the past year. The real issue is not simply more automation, but governance that assumes machines can be trusted without the same lifecycle, scoping, and audit discipline as people.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Strategies for securing Non-Human Identities”.
By the numbers:
- 50% of surveyed organizations had a breach in the past year tied to compromised machine identities, most often through poorly scoped API keys, SSL/TLS certificates, and service account tokens.
Key questions
Q: How should security teams find hidden non-human identities in cloud and application estates?
A: Start by correlating cloud inventories, CI/CD variables, secret stores, workload logs, and identity governance records.
Q: Why do overprivileged machine identities increase risk so quickly?
A: Because machine identities can operate at scale, a single broad credential can expose multiple services, environments, or datasets at once.
Q: What breaks when non-human identity credentials are long-lived and poorly rotated?
A: Long-lived credentials widen the window for reuse after exposure and make it harder to prove that access is still needed.
Practitioner guidance
- Map every non-human identity Build a complete inventory of service accounts, OAuth apps, CI/CD secrets, certificates, and agent credentials, and attach owners and business purpose to each one.
- Replace broad machine privilege with scoped policy Constrain each identity to the minimum resource, action, and environment set it needs, and remove standing access that is broader than the workload requirement.
- Shorten credential lifetime everywhere possible Move high-value NHIs to short-lived credentials and enforce rotation and revocation paths for secrets, tokens, and certificates that still need persistence.
Bottom line: Non-human identity security fails most often when organisations trust machine access by default and leave it broader than the workload requires.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 8:55 am
Blind trust in non-human identities is now a governance failure, not a configuration oversight. The article shows that many organisations still secure employees more carefully than services, workloads, and agents, even though the latter often touch the same systems and data. That mismatch breaks the basic identity assumption that access should be justified, scoped, and reviewable for every actor type. Practitioners should treat NHI trust posture as a core governance issue, not a side effect of infrastructure scale.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams govern NHI lifecycle ownership between security, IAM, and engineering?
A: Use a shared operating model with clear accountability for issuance, policy, rotation, monitoring, and retirement. Security should define risk and audit expectations, IAM should own policy and lifecycle orchestration, and engineering should enforce runtime controls. The goal is one accountable path for every identity, not a handoff chain that leaves machine access unmanaged.
👉 Read our full editorial: Best practices for non-human identity security in modern stacks
This post was modified 5 days ago by NHI Mgmt Group