Topic starter
25/06/2026 1:28 am
TL;DR: Identity programmes are moving from periodic governance to continuous control over human, machine, and agent access as SailPoint’s intent to acquire Entro combines secrets discovery, NHI scanning, and lineage mapping across more than 1,000 identity types, 1,200 credential types, and 70 enterprise sources, according to SailPoint.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “SailPoint Announces Intent to Acquire Entro to Accelerate and Enhance Agentic Fabric and Secure the Future of AI-Driven Enterprises”.
By the numbers:
- Entro's coverage extends to more than 1,000 NHI or agent types across enterprise environments.
- The platform discovers over 1,200 credential types, including secrets, keys, tokens, and certificates.
- The coverage spans 70+ critical enterprise sources, including cloud, developer, CI/CD, and SaaS environments.
Key questions
Q: What breaks when machine identities have no clear owner?
A: When machine identities have no clear owner, offboarding, remediation, and accountability all fail together.
Q: When should organisations prioritise NHI monitoring over more access approvals?
A: Organisations should prioritise NHI monitoring when identities are created frequently, reused across systems, or tied to automation and AI workflows.
Q: How do security teams know if NHI governance is actually working?
A: A working NHI programme shows clear ownership, short-lived credentials, frequent revocation, and low numbers of dormant or shared machine accounts.
Practitioner guidance
- Define the machine-identity ownership model Assign a human owner, business purpose, and remediation path to every discovered secret, token, key, certificate, and service account.
- Map active credential use to blast radius Track which tools, APIs, and data stores each NHI can reach so over-privilege is measured by reachable scope, not just account count.
- Merge discovery with offboarding workflows Treat uncovered NHIs as governed only when discovery feeds revocation, rotation, or decommissioning steps for unused or orphaned credentials.
Bottom line: The article shows that NHI governance is moving toward continuous control over machine identities, secrets, and agent access rather than periodic review alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:54 am
Identity governance is shifting from periodic review to runtime control. The article points to a market where discovery, lineage, and behavioural monitoring are being brought together because static certification cannot keep up with agentic and machine access. That does not mean recertification disappears. It means the control point has moved closer to issuance and active use, where non-human access is actually consumed.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between NHI visibility and NHI governance?
A: Visibility shows what identities exist, where they live, and how they behave. Governance adds ownership, policy, remediation, and accountability. A team can have dashboards without control, but it cannot govern identities effectively without a trusted inventory and a way to act on what it finds.
👉 Read our full editorial: SailPoint’s Entro acquisition expands NHI governance for AI era