Topic starter
12/06/2026 12:13 am
TL;DR: Machine identities are a higher-volume, lower-scrutiny attack surface where secret leakage, overprivilege, and offboarding gaps drive real breach risk, especially in cloud-native and distributed systems, according to Cerbos and OWASP's NHI Top 10. The security case is no longer about adding more identities, but about proving lifecycle, authentication, and authorization controls can keep pace with them.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Safeguarding non-human identities: Understanding and addressing the OWASP top 10 threats”.
By the numbers:
- Non-human identities often vastly outnumber human users by roughly 17:1 in typical organizations.
Key questions
Q: What breaks when non-human identities are not offboarded properly?
A: Orphaned NHIs remain valid long after the workload or integration they served is gone, which gives attackers a durable access path.
Q: Why do leaked secrets remain such a persistent NHI risk?
A: Leaked secrets persist because they are often embedded in code, pipelines, or collaboration tools, then left valid long enough for reuse.
Q: How do teams reduce the blast radius of unmanaged service accounts?
A: Teams reduce blast radius by narrowing permissions, removing inactive identities, and preventing credentials from persisting after their business purpose ends.
Practitioner guidance
- Inventory every non-human identity Map service accounts, API keys, tokens, certificates, and workload identities to an owner, a purpose, and a revocation path.
- Replace long-lived secrets with short-lived credentials Use ephemeral tokens, OIDC federation, and vault-backed secret delivery wherever a machine identity does not require persistent credentials.
- Constrain machine privilege to runtime need Review actual API calls, deployment actions, and service-to-service dependencies, then remove permissions that are not required for those tasks.
Bottom line: Machine identities are now a core attack surface because they often outnumber human users and are still governed with weaker scrutiny.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 9:20 am
The central failure is not machine identity volume, but machine identity governance lag. Cerbos's article shows that NHIs are now embedded in normal application and deployment paths, yet many programmes still treat them as secondary to human IAM. That creates a structural gap between how systems run and how access is governed. The practitioner conclusion is straightforward: machine identities need the same ownership, review, and revocation discipline as user accounts.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations stop humans from misusing NHI credentials?
A: Separate human and machine identity paths so interactive work always uses a person’s account, not a service credential. If a human needs elevated access, use approved human IAM and PAM processes so audit trails, approvals, and session controls remain intact.
👉 Read our full editorial: OWASP NHI Top 10 exposes where machine identity controls fail
This post was modified 5 days ago by NHI Mgmt Group