Topic starter
29/09/2025 12:20 pm
TL;DR: GitGuardian argues that non-human identities now outnumber humans by at least 45:1 in enterprise environments, while secrets sprawl, over-permissioned service accounts, and weak lifecycle controls leave IAM strategy incomplete. Traditional identity governance assumes stable ownership and review cycles; machine identities break both assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “IAM Strategy for CISOs: Securing Non-Human Identities”.
Key questions
Q: What breaks when non-human identities are managed outside the IAM operating model?
A: What breaks is accountability.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Inventory every non-human identity Map service accounts, API keys, tokens, and certificates across code, chat, ticketing, and vault systems so you can identify where machine access actually exists.
- Establish a single authoritative secret source Consolidate duplicate credentials into the approved enterprise secrets manager and remove unmanaged copies from other stores and repositories.
- Tie rotation to privilege revalidation Review permissions whenever a machine credential is rotated so the replacement secret does not inherit excess access from the old one.
Bottom line: Non-human identities create a governance blind spot when IAM programmes are still built around people rather than credentials that power workloads and automation.
What's in the full article
GitGuardian's full article covers the operational detail this post intentionally leaves for the source:
- The article's phased roadmap for discovering, centralising, and governing non-human identities across enterprise environments.
- Examples of how to map where NHI secrets are stored, when they were created, and whether they are still in use.
- The article's discussion of zero trust, SPIFFE, and lifecycle management as implementation directions for machine identities.
- The sector-specific IAM considerations and breach examples that support the article's governance argument.
👉 Read GitGuardian's analysis of non-human identity governance in IAM strategy →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 6:23 pm
Non-human identity governance is now a core IAM control plane, not a side concern. IAM programmes that stop at employees and contractors are already incomplete because a large share of enterprise access is exercised by machines. Those identities carry real privilege, real blast radius, and real audit obligations. The practitioner conclusion is straightforward: if the governance model does not cover service accounts, API keys, tokens, and certificates, it is not an enterprise IAM model.
A few things that frame the scale:
- 68% of organisations do not know how to fully address NHI risks, according to the Ultimate Guide to NHIs.
- Enterprises manage far more machine secrets than human ones: 20 times as many according to Enterprise Strategy Group, and 45 times according to GitGuardian.
A question worth separating out:
Q: Should organisations manage human and machine identities under the same access governance model?
A: They should govern them under the same programme, but not with identical controls. The shared requirement is visibility into who or what is authorised. The difference is that machine identities usually need tighter ownership, shorter lifecycle expectations, and clearer operational handoff. A single programme works best when it distinguishes subject type while keeping one governance record.
👉 Read our full editorial: Non-human identity governance is the missing layer in IAM strategy