Topic starter
03/06/2026 7:25 pm
TL;DR: 2025 CISO planning will be shaped by non-human identities, zero trust, compliance, and supply chain risk, as NHIs proliferate and traditional perimeter models fall short, according to Entro Security. The real issue is that access governance, review, and rotation assumptions were built for slower human-paced systems, not sprawling machine identities.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “How CISOs should prepare for 2025”.
Key questions
Q: How should security teams implement Zero Trust for non-human identities?
A: Start by inventorying every machine identity, assigning an owner, and mapping its access to a specific business function.
Q: Why do third-party tokens create disproportionate supply chain risk?
A: Because delegated machine credentials often bridge environments and inherit access that is broader than the original business need.
Q: What do teams get wrong when they try to manage NHIs like human users?
A: They assume review cadences, ownership models, and session boundaries behave the same way for machines as they do for people.
Practitioner guidance
- Inventory every non-human identity Establish a current inventory of service accounts, API keys, tokens, certificates, and bots across code, repositories, and collaboration tools.
- Rotate and scope NHI secrets aggressively Replace long-lived credentials with tightly scoped secrets and enforce regular rotation for identities that cross environments or vendor boundaries.
- Extend IAM and PAM to machine access Use IAM controls and privileged access governance for both human and non-human identities, including strong authentication, granular permissions, and revocation paths for vendor-issued access.
Bottom line: The article frames 2025 as a year when non-human identities, Zero Trust, compliance, and supply chain exposure converge into one governance problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 7:29 pm
Access governance for NHIs is now a core CISO planning issue, not an engineering detail. The article correctly places machine identities alongside Zero Trust and compliance because the control problem has moved from user authentication to continuous machine access governance. When service accounts, API keys, and vendor tokens proliferate faster than teams can inventory them, IAM and PAM programmes inherit a much larger attack surface. The practitioner conclusion is that NHI governance must be budgeted and owned as a first-class security discipline.
A question worth separating out:
Q: How do organisations know if NHI governance is actually working?
A: They can answer three questions consistently: what each identity is for, who owns it, and when it should be removed or re-authorised. If any NHI cannot be inventoried, classified, and tied to a current purpose, the governance programme is only partially effective. Auditability should be visible in the evidence, not assumed from policy language.
👉 Read our full editorial: How CISOs should prepare for 2025: NHI, ZTA, and supply chain risk