Topic starter
03/06/2026 7:25 pm
TL;DR: 2025 planning will force non-human identity governance, Zero Trust, compliance, and supply chain risk into one control problem, according to Entro Security. Machine credentials need inventory, ownership, and scoped rotation to keep delegated access auditable and contained.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “How CISOs should prepare for 2025”.
Key questions
Q: Why do third-party tokens create disproportionate supply chain risk?
A: Because delegated machine credentials often bridge environments and inherit access that is broader than the original business need.
Q: What do teams get wrong when they try to manage NHIs like human users?
A: They assume review cadences, ownership models, and session boundaries behave the same way for machines as they do for people.
Q: How should security teams implement Zero Trust for non-human identities?
A: Start by inventorying every machine identity, assigning an owner, and mapping its access to a specific business function.
Practitioner guidance
- Inventory every non-human identity Establish a current inventory of service accounts, API keys, tokens, certificates, and bots across code, repositories, and collaboration tools.
- Rotate and scope NHI secrets aggressively Replace long-lived credentials with tightly scoped secrets and enforce regular rotation for identities that cross environments or vendor boundaries.
- Extend IAM and PAM to machine access Use IAM controls and privileged access governance for both human and non-human identities, including strong authentication, granular permissions, and revocation paths for vendor-issued access.
Bottom line: The article frames 2025 as a year when non-human identities, Zero Trust, compliance, and supply chain exposure converge into one governance problem.
Glossary terms: Non-Human Identity (NHI), Zero Trust, Third-Party NHI, Trust debt
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
03/06/2026 7:29 pm
Access governance for NHIs is now a core CISO planning issue, not an engineering detail. The article correctly places machine identities alongside Zero Trust and compliance because the control problem has moved from user authentication to continuous machine access governance. When service accounts, API keys, and vendor tokens proliferate faster than teams can inventory them, IAM and PAM programmes inherit a much larger attack surface. The practitioner conclusion is that NHI governance must be budgeted and owned as a first-class security discipline.
A question worth separating out:
Q: How do organisations know if NHI governance is actually working?
A: They can answer three questions consistently: what each identity is for, who owns it, and when it should be removed or re-authorised. If any NHI cannot be inventoried, classified, and tied to a current purpose, the governance programme is only partially effective. Auditability should be visible in the evidence, not assumed from policy language.
👉 Read our full editorial: How CISOs should prepare for 2025: NHI, ZTA, and supply chain risk