Topic starter
08/06/2026 4:31 pm
TL;DR: Enterprises now manage 82 machine identities for every human user, and security teams are still focusing on mature domains while the highest-risk areas, especially AI and development, create the most ungoverned NHI sprawl, according to Clutch Security. Security investment is misaligned with where machine identity risk actually lives, so visibility, lifecycle control, and cross-domain governance have become the real control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Clutch Security: “Why 82% of Your Attack Surface Is Invisible to Your Security Team”.
By the numbers:
- Organizations now manage 82 machine identities for every human user in the enterprise, according to Clutch Security.
Key questions
Q: What breaks when machine identities are created inside business workflows without IAM ownership?
A: Ownership, rotation, and offboarding all become ambiguous, so credentials persist after the business need changes.
A: They create identities faster, with broader privileges and less consistent lifecycle governance.
Q: What are the signs that machine identity management is failing in an organisation?
A: Common signs include incomplete inventory, spreadsheet based tracking, manual renewal processes, unclear ownership, and repeated certificate expiry events.
Practitioner guidance
- Audit identity creation by business workflow Inventory where OAuth tokens, service accounts, API keys, and other machine identities are created inside sales, development, legal, AI, and vendor workflows.
- Prioritise governance in high-velocity domains Assign stricter lifecycle review to AI and development domains first, because they combine rapid credential growth with weak oversight and elevated privileges.
- Separate delegated access from primary accounts Map downstream credentials and inherited access paths independently so one user action does not hide multiple machine identities with different blast radii.
Bottom line: Machine identity sprawl is being created by business workflows faster than IAM programmes can assign ownership or lifecycle control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/06/2026 6:13 pm
Attack surface visibility breaks when identity creation shifts into business workflows. Security teams still organise around systems, but the article shows that the real source of NHI growth is workflow-driven access creation inside sales, DevOps, legal, and AI operations. That means the inventory problem is really an ownership and lifecycle problem. Practitioners should stop treating visibility as a scan result and start treating it as a governed process boundary.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
A question worth separating out:
Q: How should security teams respond when machine identities span multiple business domains?
A: Treat cross-domain credentials as a separate governance class and review them for delegated scope, overlapping privileges, and ownership gaps. A machine identity that can cross from AI into development or production should be monitored as a blast-radius problem, not as a normal account.
👉 Read our full editorial: Why 82% of enterprise attack surface stays invisible to IAM
This post was modified 5 days ago by NHI Mgmt Group