Notifications
Clear all
Topic starter
14/05/2026 4:44 pm
TL;DR: Identiverse 2026 in Las Vegas will focus on identity threat detection, secrets lifecycle management, AI agent identity implications, and trust models for distributed systems, according to GitGuardian. The operational question is no longer whether machine identities belong in IAM, but how governance, rotation, and visibility keep pace with NHI sprawl.
NHIMG editorial — here’s why we think this discussion matters
Questions worth separating out
Q: How should security teams govern non-human identities at scale?
A: Security teams should govern non-human identities with the same discipline used for human access, but with stronger lifecycle controls.
Q: Why do AI agents create new identity risks for IAM teams?
A: AI agents create new identity risks because they combine authentication, delegation, and autonomous execution.
Q: What is the difference between secrets rotation and lifecycle governance?
A: Secrets rotation changes a credential, but lifecycle governance controls the entire identity from creation to retirement.
Practitioner guidance
- Inventory machine identities continuously Build a current register of service accounts, API keys, tokens, and certificates across cloud, CI/CD, and code repositories.
- Enforce lifecycle controls for secrets Require issuance, rotation, revocation, and offboarding workflows for every secret, including short-lived credentials used in automation.
- Constrain AI agent tool scope Assign each agent a narrow task boundary and explicit tool permissions, then review downstream access regularly.
As AI agents and automation layers expand, teams will need continuous visibility into entitlement, runtime use, and revocation paths, with governance anchored in standards such as the NIST AI Risk Management Framework?
👉 Register for GitGuardian's Identiverse 2026 event details and booth information →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/05/2026 4:47 pm
A few things worth adding from our research at NHI Mgmt Group.
Machine-led identity has become the new default risk boundary. As organisations add more service accounts, credentials, and autonomous agents, the old separation between human IAM and workload access control stops making operational sense. Security teams now need a single view of identity entitlement, usage, and retirement across both classes of actor. The practical conclusion is simple: treat every machine credential as a governed identity with measurable lifecycle risk.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: When does machine identity risk become a zero trust issue?
A: Machine identity risk becomes a zero trust issue when credentials can be reused, shared, or left active beyond their intended purpose. Zero trust depends on continuous verification and minimal standing privilege, which means NHIs must be tightly scoped and frequently revalidated. If a secret can persist silently, the trust model is already weakened.
👉 Read our full editorial: Identiverse 2026 spotlights machine identity governance for IAM teams
