Topic starter
22/07/2026 4:37 pm
TL;DR: Data governance defines who can access data, under what conditions, and with what accountability, while data management keeps storage, pipelines, and delivery working. Apono’s article argues that the distinction becomes more consequential as NHIs expand access, and cites GitGuardian’s 2025 report showing 23.77 million new secrets leaked on GitHub in 2024, a 25% year-over-year increase. Once access is automated, governance without enforcement becomes paperwork.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Data Governance vs Data Management: 7 Differentiating Factors”.
By the numbers:
- 23.77 million new secrets leaked on GitHub in 2024, a 25% year-over-year increase, according to GitGuardian’s 2025 State of Secrets Sprawl report cited by Apono.
Key questions
Q: What breaks when data governance does not enforce NHI access controls?
A: Governance breaks when policies exist on paper but NHIs still hold standing access to sensitive data.
Q: Why do long-lived credentials create more governance risk than brokered access?
A: Long-lived credentials can be reused across systems, inherited by workflows, and exposed in logs or code, which expands the identity blast radius.
Q: How can security teams tell whether data management is masking access overexposure?
A: Look for systems that are reliable, well-instrumented, and still widely accessible through NHIs that lack clear expiry or ownership.
Practitioner guidance
- Define governance ownership for machine-held access Map each sensitive dataset to a human owner and the NHIs that can reach it, including pipelines, service accounts, and agent identities.
- Replace standing access with time-bound enforcement Use short-lived access and task-scoped approvals so data access expires with the work rather than persisting as a permanent entitlement.
- Inventory embedded secrets across code and automation Scan repositories, CI systems, and scripts for long-lived credentials, then track which datasets those credentials can reach.
Bottom line: The article’s core warning is that data governance fails when non-human access is allowed to outlive its task, even if the underlying data platform remains stable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
24/07/2026 4:13 pm
Governance fails first at enforcement, not at policy design. The article is correct to separate data governance from data management, but the deeper point is that governance becomes symbolic when NHIs carry the real access path. Policies can define intent, yet service accounts and pipelines decide whether that intent is enforceable. The practitioner lesson is to measure governance by whether it constrains machine-held access, not by whether the policy library is complete.
A few things that frame the scale:
- 30.9% of organisations store long-term credentials directly in code, according to the Ultimate Guide to NHIs.
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations review secrets management or data governance first?
A: Start with the governance question, because it defines which data should be reachable and by whom. Then align secrets management to enforce those decisions through short-lived credentials, revocation, and audit trails. If the access model is unclear, better secret handling will not fix the underlying ownership problem.
👉 Read our full editorial: Data governance vs data management in NHI-driven environments
This post was modified 5 days ago by NHI Mgmt Group